AI agents with too many keys: why permissions are the new identity problem

Key points

• AI agents, meaning software helpers that carry out tasks on their own, are being handed the same broad access rights as human staff, often without proper checks.
• Identity firm Token Security argues that most agentic AI systems today run with far more permissions than they need, creating a fresh class of insider risk.
• The core problem is authorisation, meaning what the agent is allowed to do, not authentication, meaning proving who it is.
• Applying least privilege, a principle where each account gets only the access it strictly needs, is the recommended fix.
• Analysts expect regulators to start asking companies how they govern non-human identities within the next year.

The security industry spent two decades teaching companies to lock down human logins. Now a new type of user has arrived, and it does not sleep, does not ask questions, and holds a copy of your API keys.

AI agents are software helpers that can plan and carry out multi-step tasks on their own. Book a flight. Reconcile an invoice. Pull a report from Salesforce and email it to a client. To do any of that, the agent needs credentials, and companies are handing them over fast.

According to a new analysis from identity vendor Token Security, first flagged by BleepingComputer, that is where the trouble starts.

What is actually going wrong?

The agents are getting far more access than they need, and nobody is watching what they do with it. In identity terms, the failure is on the authorisation side (what an account is allowed to do), not the authentication side (proving the account is who it claims to be).

A human employee who needs to read one folder tends to be given access to that folder. An AI agent asked to "handle expenses" is often handed a token that can read, write and delete across an entire finance system. The agent then improvises, because improvising is exactly what these systems are built to do.

That improvisation is the point. It is also the risk.

Why is this different from a normal service account?

Because the agent decides its own next move. A traditional service account, meaning a non-human login used by one specific program, does the same narrow job forever. You can predict its behaviour and write rules around it.

An AI agent chooses actions based on a prompt. Feed it the wrong instruction, whether by accident or through a prompt-injection attack (where a hostile message hidden in a document tricks the AI into misbehaving), and it will happily use every permission it holds. If those permissions include your customer database, so be it.

MFA, meaning multi-factor authentication, would not help here. The agent already holds a valid token. The question is what that token is allowed to touch.

How should companies fix it?

Treat every AI agent as its own identity, and give it the narrowest possible permissions. Token Security calls this intent-based access: the agent gets rights tied to the specific task it was asked to do, not a permanent all-access badge.

In practice that means four things.

OAuth 2.0 already supports scoped, short-lived tokens through mechanisms in RFC 6749 and refresh-token rotation in RFC 6819. The plumbing exists. The willpower, often, does not.

Should ordinary people care?

Yes, quietly. If your bank, your airline or your doctor's surgery starts using AI agents to handle your data, the security of your information now depends on how carefully those agents were set up. You will not see it. You cannot audit it. But you can ask.

When a company tells you it uses AI to "streamline service", a fair question is whether that AI can see only your record, or everyone's.

The answer matters.