Agentic AI identity security: when AI agents hold the keys

In August 2025, attackers stole OAuth tokens from the Salesloft Drift integration and used them to export Salesforce , in a campaign that potentially impacted over 700 organizations. The tokens gave attackers the trusted application’s access.

Credentials have traditionally authorized a person, or a workload whose behavior was largely predictable. An AI agent’s credential authorizes something else: a system that can select, sequence, and delegate actions across multiple tools on its own. That creates three scenarios: an attacker steals an agent’s credential, compromises the agent or its orchestrator, or manipulates the agent into misusing its own valid access. The third is the most specific to agentic systems, and the focus here.

• AI agents use or obtain access through service accounts, API keys, and OAuth tokens that may be brokered, delegated, or retrieved at runtime.
• Agent deployments expand the non-human identity surface and increase the need to track access at the level of individual actions.
• IAM and PAM govern authorization and credentials well, but authorization alone does not confirm whether a sequence of individually valid actions still serves the agent’s task.
• Deception strengthens Identity Threat Detection and Response (ITDR) with a high-confidence runtime signal, alongside inventory, least privilege, and monitoring.
• ShadowPlex Identity Protection deploys deceptive artifacts across agent-accessible identity systems, cloud workloads, and secrets managers.

Three multipliers explain why agent identity behaves differently from human identity. Each later section maps back to one or more of them.

Scope. An agent can aggregate permissions across tools, services, and workflows that organizational boundaries previously kept separate. A single task may require the ticketing system, the cloud console, and the CRM at once. That aggregation is harder to right-size than any single person’s access.

Autonomy. An agent can choose and chain individually permitted actions on its own. Each step may look routine, so harmful intent is difficult to infer from any single event, even with a behavioral baseline in place.

Trust chain. Credentials, context, delegated authority, and tool access can pass through orchestrators and sub-agents. A manipulation introduced at one point can expand its consequences as it moves down the chain, without any single handoff looking wrong.

The attack surface below is a scope problem. Orchestration is a trust-chain problem. The limits of IAM, PAM, and ITDR are an autonomy problem. Deception is the runtime signal that cuts across all three.

Service account credentials carry broad permissions that are often rotated infrequently. Security teams typically set them up once, and their access is rarely minimized, even if the task they were made for changes.

API keys used by agent configurations create risk whether they are hardcoded, stored in a secrets manager, or retrieved at runtime. Exposure depends on how a key is handled, not only where it sits.

Stolen OAuth bearer tokens let attackers use granted permissions without knowing a password. Short token lifetimes reduce exposure but do not prevent misuse before expiration, and stolen refresh tokens can extend access.

Role assumption chains let an agent take on additional IAM roles as part of its normal work, creating an escalation path if the logic behind it is ever manipulated.

Each of these is a scope problem, and new agent deployments can add to this non-human identity surface.

Multi-agent systems can pass context and delegated authority between agents, with credentials brokered or scoped separately. An orchestrator can act as the manager agent, splitting the work (and access) across each helper so it can finish its part. Risk grows when agents trust prior handoffs without checking task scope.

That makes the trust chain the most consequential multiplier. A single manipulated agent, not necessarily a stolen credential, can extend its reach across the orchestration. A manipulated orchestrator can instruct sub-agents to access resources outside the intended workflow without any individual authentication event looking invalid.

Illustrative scenario: a support agent receives a prompt injection through retrieved content. Using its valid OAuth session, it calls an approved automation tool, which in turn invokes a sub-agent with access to a cloud role. No individual authentication event in this chain looks invalid. Deception can expose the deviation when the workflow attempts to use a deceptive credential or follows a monitored identity path.

Access reviews and preventive controls reduce exposure, but defenders also need runtime context to recognize when a sequence of permitted actions takes an agent beyond its assigned task.

Identity and access management (IAM) governs which identities exist and which permissions they carry. Privileged access management (PAM) governs how privileged credentials are issued, vaulted, and rotated. ITDR correlates identity activity, privilege changes, and other telemetry to detect credential abuse and identity threats.

Permission and authentication data alone do not confirm whether a sequence of individually authorized actions still serves the task the agent was deployed for. That is the autonomy multiplier at work. Agent activity can be automated and high-frequency, using valid credentials, which strains baselines built around human behavior.

Deception provides a preemptive cybersecurity layer for an agentic identity program, alongside inventory, least privilege, and monitoring. It does not replace IAM, PAM, EDR, SIEM, or AI guardrails. A manipulated or misconfigured agent can create an insider threat by misusing access it already holds.

ShadowPlex Identity Protection extends ITDR into agentic AI environments through Acalvio’s 360 Deception framework: honey users in Active Directory, deceptive API keys in secrets managers, and deception along cloud IAM paths that can trigger alerts on unauthorized privilege escalation attempts. Deception answers a question the rest of the stack strains to answer on its own: why did anything use a credential no approved workflow requires? These assets carry no production purpose and should sit outside approved agent workflows, making attempted use a high-confidence signal of activity that warrants investigation.

Hand-built, hand-fed honeypots are difficult to scale with agent credential churn. ShadowPlex uses AI-driven recommendations and automated deployment to place deceptions where attackers are likely to look. In the U.S. Navy ANTX FY25 exercise, Acalvio reported 100% true positive alerts and 80% denial of attacker objectives against automated, credential-driven techniques. That exercise was not an AI-agent deployment, but it tested the same detection mechanism.

Seeding deceptive credentials in agent-accessible secrets managers

Consider a deceptive API key stored in a vault an agent is permitted to query, labeled like a production credential for a payment service. No approved workflow references it. If an agent attempts to use it, that is a high-confidence signal the agent is acting outside its task. Placement should account for agents that legitimately list vault contents, so alerts key on use, not enumeration.

• Non-human identity inventory. You cannot protect agent identities you have not found, and forgotten agents often keep access no one revisits. Map each identity to an owner, task, and the tools it can access.
• Least-privilege enforcement. Give each agent only as much access as it requires to complete its task, and watch for drift as agents accumulate permissions. Use short-lived, task-scoped access where supported, and revalidate delegation at each handoff.
• Honeytoken deployment. Place honeytokens in agent-accessible credential stores: Active Directory, secrets managers, token vaults, and cloud role paths.
• ITDR integration and response. Route deception alerts to responders with the priority a high-confidence signal deserves. Preserve the tool-call chain, identify the agent’s owner, and define when to pause execution and revoke affected access.
• Emulation-informed access reviews. Use adversary emulation findings so reviews test how agents can be manipulated, not only what they hold.

ShadowPlex Identity Protection integrates with identity platforms including Microsoft, Okta, Ping Identity, CyberArk, and Delinea, and provides coverage across the AWS, Azure, and GCP cloud platforms.