AI agents with too many keys: why permissions are the new identity problem
As companies rush to deploy AI assistants that act on their behalf, security researchers warn the real danger is not the AI itself but the sweeping access rights it inherits.
Key points
- AI agents, meaning software helpers that carry out tasks on their own, are being handed the same broad access rights as human staff, often without proper checks.
- Identity firm Token Security argues that most agentic AI systems today run with far more permissions than they need, creating a fresh class of insider risk.
- The core problem is authorisation, meaning what the agent is allowed to do, not authentication, meaning proving who it is.
- Applying least privilege, a principle where each account gets only the access it strictly needs, is the recommended fix.
- Analysts expect regulators to start asking companies how they govern non-human identities within the next year.
The security industry spent two decades teaching companies to lock down human logins. Now a new type of user has arrived, and it doesn't sleep, doesn't ask questions, and holds a copy of your API keys.
AI agents are software helpers that can plan and carry out multi-step tasks on their own. Book a flight. Reconcile an invoice. Pull a report from Salesforce and email it to a client. To do any of that, the agent needs credentials, and companies are handing them over fast.
According to a new analysis from identity vendor Token Security, first flagged by BleepingComputer, that's where the trouble starts.
What is actually going wrong?
The agents are getting far more access than they need, and nobody's watching what they do with it. In identity terms, the failure is on the authorisation side (what an account is allowed to do), not the authentication side (proving the account is who it claims to be).
A human employee who needs to read one folder tends to be given access to that folder. An AI agent asked to "handle expenses" is often handed a token that can read and delete across an entire finance system. The agent then improvises, because improvising is exactly what these systems are built to do.
That improvisation is the point. It's also the risk.
Why is this different from a normal service account?
Because the agent decides its own next move. A traditional service account, meaning a non-human login used by one specific program, does the same narrow job forever. You can predict its behaviour and write rules around it.
An AI agent chooses actions based on a prompt. Feed it a hostile instruction through a prompt-injection attack (where a message hidden in a document tricks the AI into misbehaving) and it'll happily use every permission it holds. If those permissions include your customer database, so be it.
MFA, meaning multi-factor authentication, wouldn't help here. The agent already holds a valid token, and the question is what that token is allowed to touch. We first reported on how AI agents break traditional security assumptions on 16 July, and Token Security has now put specific numbers to the permission problem.
How should companies fix it?
Treat every AI agent as its own identity, and give it the narrowest possible permissions. Token Security calls this intent-based access: the agent gets rights tied to the specific task it was asked to do, not a permanent all-access badge.
In practice that means four things.
| Control | What it does |
|---|---|
| Unique identity per agent | Stops one compromised agent from impersonating another |
| Short-lived tokens | Limits damage if credentials leak |
| Scoped permissions | Restricts the agent to one system or dataset |
| Full audit logging | Records every action the agent takes, for review |
OAuth 2.0 already supports scoped, short-lived tokens with refresh-token rotation. The plumbing exists; the willpower is another matter.
Should ordinary people care?
Yes, quietly. If your bank or your doctor's surgery starts using AI agents to handle your data, the security of your information now depends on how carefully those agents were set up. You won't see it and you can't audit it, but you can ask.
When a company tells you it uses AI to handle your account, a fair question is whether that AI can see only your record or everyone's.
The answer matters. Lorna's read on this: the permission problem is being solved in slide decks faster than it's being solved in prod, and the gap between the two is exactly where the next serious breach will live.
