AI Agents Are Non-Human Identities Now: The 2026 Credential Sprawl Problem

The ratio that should worry you more than the prompt injection headline

Most of the 2026 conversation about agentic AI risk still centres on what a malicious prompt can trick an agent into doing. That is a real risk, and we have written about it in our MCP security risks piece. But a quieter number from this year's identity research points at something structurally bigger: non-human identities now outnumber human identities 144 to 1 in cloud-native environments, up from 92 to 1 just two years earlier, a 56% jump in the ratio in a single year, according to 2026 research aggregated by the Cloud Security Alliance and reported across the non-human identity security community. In a typical enterprise, bots, service accounts, and AI agents now outnumber human users roughly 100 to 1.

AI agents are the fastest-growing slice of that population, and they are also the least well governed slice of it. That combination, growth plus governance gap, is exactly the shape of every credential-driven breach the security industry has seen before, just compressed into a shorter timeline because agents provision and act faster than any human onboarding process ever did.

Why an agent's credential is not just another service account key

It is tempting to file "AI agent identity" under the same bucket as "service account management," a problem security teams have handled for years. The shape of the credential is similar, a key or token that authenticates a non-human caller, but the behaviour behind it is not.

A traditional service account calls the same handful of APIs in the same pattern, day after day, for years. Its blast radius is knowable because its behaviour is static. An AI agent is the opposite of static: it acquires permissions dynamically at runtime, can spawn sub-agents to delegate parts of a task, invokes external APIs and tools it was not explicitly told to call in advance, writes and executes code, and chains actions across many systems in a single session. Each of those behaviours expands what a single compromised or over-scoped credential can reach, well past what a static service account could ever have done with the same nominal permissions.

The 2026 governance data reflects exactly this gap. A Cloud Security Alliance analysis of token sprawl found more than 16% of organisations do not track the creation of AI-related identities at all, meaning an agent can come into existence, hold a credential, and act, with no inventory entry anywhere. Nearly a quarter of organisations take more than 24 hours to rotate or revoke a credential after it is potentially exposed, and 30% take over a day just to triage a high-severity leak. Meanwhile most organisations report agents are already running in production, across public cloud, on-premises, and hybrid environments. Production usage arrived before the lifecycle discipline did.

What "treating agents as identities" actually requires

The instinct in a lot of organisations is to give an agent a developer's personal token, or a shared service credential everyone already has lying around, because it is faster to ship. That shortcut is precisely what the 22% figure above describes: only about one in five organisations currently treats agents as independent identities with their own lifecycle. Doing it properly means four things, none of them exotic, all of them frequently skipped under deadline pressure.

Issue a scoped credential per agent, not a shared one. Odock's virtual API keys can be scoped to an organisation, team, or user principal, so an agent's traffic is attributable to a specific chain rather than to "whichever developer's key was handy." See scope and principals for how that chain is built.

Grant access explicitly, per model and per tool. An agent should not inherit blanket access because it is convenient. Model and MCP access grants exist precisely so an agent's reach is the intersection of what it needs, not the union of everything the organisation has ever connected. MCP security covers tool-level allow and block lists for exactly this reason.

Rotate without breaking everything downstream. The reason rotation lags for days in the wild is usually that rotating a credential means re-wiring every integration that depends on it. Odock's key lifecycle and rotation rotates in place, the key id stays constant, model access, budgets, quotas, and usage attribution stay attached, and only the secret changes. That is what turns "rotation should happen within an hour" from an aspiration into something operationally realistic.

Make every action attributable after the fact. A revoked or rotated credential answers "what can this agent do now." A usage record answers "what did this agent already do," which is the question that actually matters during an incident review.

The coming complication: agent-to-agent traffic

The identity problem gets harder as agents start talking to other agents rather than only to tools. Protocols like Agent2Agent, stewarded by the Linux Foundation since Google introduced it in 2025, let agents advertise capabilities and negotiate tasks through a machine-readable AgentCard that can declare supported auth schemes such as OAuth 2.0, OpenID Connect, API keys, or mutual TLS. That is a real step forward for interoperability, and it is explicit about what it does not solve: the protocol does not provision credentials or decide authorization for you. Researchers analysing A2A's threat surface point at fake agent advertisement, unauthorized registration, and recursive delegation loops as protocol-specific risks precisely because identity and authorization are left to whoever operates the deployment.

That gap is exactly the reason identity cannot be an afterthought bolted onto agent frameworks. Whatever protocol your agents speak to each other, something still has to answer "which credential is this, what is it allowed to touch, and can I revoke it in seconds," and that answer has to live at the layer every request actually passes through, not in each framework's own auth code.

The honest limits here

Gateway-issued identity fixes the part of the problem that is infrastructural: scoping, rotation, revocation, and attribution. It does not fix an agent being tricked by a malicious input into misusing the access it legitimately holds, that is a prompt- and content-level problem, covered by tools like Odock's SafetySec engine rather than by identity management alone. The two layers are complementary, not substitutes. An agent with a tightly scoped, rotatable identity and no content inspection can still be manipulated into misusing what it is allowed to touch. An agent with excellent content inspection but a shared, unscoped, unrotatable credential is one leaked secret away from an unbounded blast radius. You need both, and most 2026 breach data suggests organisations currently have neither in a mature state.

Where Odock.ai comes in

I built Odock's virtual API key system with exactly this gap in mind, so read the following as an interested party's take. Every application, team, user, and agent that calls through Odock gets its own scoped virtual key, with explicit model and MCP access grants, budgets, quotas, and in-place rotation, plus a usage record on every single call. That means an agent is never a shared secret pretending to be an identity, it is an actual identity with a real lifecycle, from issuance to revocation.

If your organisation already has agents in production and is part of the roughly 78% still treating them as static credentials rather than governed identities, the fix is not a bigger spreadsheet of who has which key. It is putting agent traffic behind a gateway that was built to issue, scope, rotate, and revoke identities as a first-class operation. Request a demo or start with MCP governance at Odock and give your agents an identity lifecycle before an incident forces you to build one under pressure.

Sources

• The Non-Human Identity Governance Vacuum, Cloud Security Alliance
• Token Sprawl in the Age of AI, Cloud Security Alliance
• The 2026 Data Breach Investigations Report Confirms It: Identity Is the Control Plane for Agentic AI, Token Security
• Non-human identity sprawl is agentic AI's real risk, InformationWeek
• Odock virtual API keys
• Odock MCP security