AI Agents Are Making Security Playbooks Obsolete. Identity Is the Fix.

Key points

• AI agents now act inside company systems at machine speed, creating identities and permissions faster than security teams can track them.
• Token Security argues that traditional security workflows, designed for human-paced changes, cannot handle the volume or unpredictability of agent activity.
• The proposed fix is a live identity foundation: a real-time map of every human, machine, and AI identity operating in a company's cloud.
• Security teams need custom workflows built on that foundation, not one-size-fits-all rules, because every environment runs agents differently.
• Agent sprawl, meaning uncontrolled growth of AI accounts and their access, is already outpacing manual review at most large companies.

Security teams have a new problem, and it doesn't look like a hacker in a hoodie.

It looks like a helpful AI assistant, quietly spinning up accounts, requesting access to files, and calling other software tools on behalf of employees. Thousands of times an hour. Without asking.

AI agents, meaning software programs that use large language models to take actions on their own, are now embedded across corporate systems. They read email, query databases, trigger payments. All of it runs under identities that most security teams have no clean way to see, let alone govern.

Token Security, an identity security vendor, laid out the problem in a piece first covered by BleepingComputer. The old playbook, they argue, is broken. We first covered Token Security on 16 July 2026, and the identity inventory problem they raised then has only sharpened.

Why can't existing security tools handle AI agents?

Because those tools assume a human is on the other end.

Traditional identity and access management, the systems that decide who can log in and open what, were designed around people. A person joins the company, gets an account, is added to a few groups, and eventually leaves. That whole lifecycle happens at human speed: days, weeks, months.

An AI agent moves at machine speed. It can spawn sub-agents and connect to external services in seconds, requesting new permissions along the way. Hundreds of iterations can complete before a security analyst has finished their coffee.

Quarterly access reviews and manual approvals are simply too slow. By the time anyone reviews an agent's access, that agent has done the work and likely been replaced by a newer version.

What does a "live identity foundation" actually mean?

It means a security system that watches every identity in real time.

Not just employees. Also service accounts (the technical logins software uses to talk to other software), API keys (secret codes that let one program call another), and now AI agents and the sub-agents they spawn.

Token Security's argument is that you cannot govern what you cannot see. A live foundation continuously discovers every identity, tracks what it has access to, and flags when something drifts, for example when an agent quietly gains admin rights it never had yesterday.

On top of that foundation, security teams need to build their own workflows. One company might require human sign-off before an agent touches financial data; another might auto-revoke any agent that goes idle past a set threshold. Rigid, vendor-defined rules don't fit every environment, and that's the whole point.

What should companies do right now?

The practical starting point is unglamorous: inventory.

Most security teams can't answer basic questions today. How many AI agents are running in our cloud? Who deployed them? Which ones are still active from a pilot that ended months ago? Until those questions have answers, no policy will hold. Companies getting ahead of this treat AI agents like employees: onboarded on a schedule, watched while active, and cleanly offboarded.

The hackers have noticed. As our 9 July report found, stolen credentials tied to AI gateways are already a target, and an agent with broad access is a far juicier prize than one employee's laptop.

Companies waiting for a clean industry standard will be writing incident reports instead. The rewrite is already underway.