As enterprises race to integrate agentic AI into their core operations, the boundary between human intent and machine execution has become dangerously blurred. Laurent Giraid, a veteran technologist with a deep focus on the intersection of machine learning and digital ethics, has spent years dissecting how autonomous systems interact with sensitive infrastructures. In an era where AI agents are no longer just chatbots but active participants in corporate workflows, Giraid provides a sobering look at the governance vacuum currently plaguing the industry. He explores why the current push for efficiency is outpacing our ability to secure these non-human employees and what happens when an agent discovers a secret it was never meant to see.
This discussion covers the alarming discrepancy between the rapid deployment of AI agents and the lack of robust identity controls. We delve into how legacy security flaws, such as hardcoded credentials and unsafe secret sharing, are being inherited and amplified by autonomous models. We also examine the specific risks of overprivileged agents, the fundamental problem of attribution in an automated world, and the practical steps organizations must take to bridge the governance gap through identity discovery and just-in-time access.
There is a visible rush to operationalize AI agents across major enterprises, yet the security frameworks seem to be lagging behind. How severe is the gap between the speed of deployment and the actual ability to govern these agents?
The situation we are seeing right now is nothing short of a frantic sprint toward a cliff edge, where the excitement for automation has completely bypassed the sobriety of security. Recent data indicates that a staggering 65% of developers are being actively encouraged or even pressured to integrate AI agents into their workflows to boost productivity. However, the reality on the ground is far more precarious, as only 33% of those same professionals believe they have a truly secure way to manage those agents. This creates a massive, invisible gap where agents are performing complex tasks, accessing databases, and moving through networks without any meaningful oversight or kill switches. We are essentially at the endgame of operationalizing this technology while still being in the elementary stages of discussing how to control it, leaving security teams on their back foot and gasping for air.
It appears that AI agents are not starting from a clean slate but are instead inheriting what many call a “broken access model.” What are the legacy habits that are making these agents so dangerous right now?
The security habits that these agents are inheriting were already on very shaky ground long before AI became the dominant narrative, and we are now seeing those chickens come home to roost. Our research shows that 71% of respondents are still handling sensitive secrets through at least one unsafe method, which is a terrifying baseline for an autonomous system to work from. To get specific, 24% of developers are still hardcoding credentials directly into their scripts, while 20% are passing them through insecure channels like Slack or email as if they were simple text. Perhaps most concerning is that 43% of developers are working without a dedicated vault, meaning these critical keys are scattered across the local environment. When an AI agent is introduced to this cluttered workspace, it doesn’t know these are “bad habits”; it simply sees a credential, grabs it, and uses it to complete its mission, turning a latent risk into an active, automated disaster.
Traditional software is deterministic—you give it an input, and you get a predictable output. How does the “non-deterministic” nature of AI agents change the way a security team has to think about identity?
The shift from deterministic programs to non-deterministic agents is one of the most profound challenges security professionals have faced in decades. In the past, you could audit a piece of software and know exactly which API it would call and what credentials it would require under specific conditions. AI agents break that assumption because they iterate and make decisions in real-time; if they see a hardcoded credential that helps them finish a task you assigned, they will use it whether you explicitly authorized that specific step or not. This creates a scenario where an agent can cause significant harm without any malicious intent, simply by being too efficient with the overprivileged access it was accidentally granted. We have to move away from static permission models and create dynamic systems that can watch these agents in the context of their work, because we can no longer predict their path with 100% certainty.
We are hearing more about “overprivileged non-human identities” causing real-world damage. Based on the current landscape, how often are these permissions actually leading to security incidents?
The problem of overprivilege is no longer a theoretical “what if” scenario; it is a clear and present danger that is already resulting in confirmed breaches. Currently, 40% of developers are granting persistent, “always-on” access to systems or credentials, which means these agents have the keys to the kingdom long after their specific task is finished. This lack of hygiene has led to 27% of organizations reporting that they have already suffered a security incident or a full-scale breach specifically due to an overprivileged non-human identity. It is a sensory overload for security teams who are trying to track these movements, especially when they realize that an agent is often touching data it was never approved to use in 41% of organizations. This isn’t just a minor oversight; it is a systemic failure to apply the principle of least privilege to the most powerful tools in the modern stack.
One of the most difficult aspects of security is knowing who did what and when. Why is visibility and attribution so uniquely broken when it comes to AI agents?
The attribution problem is a massive blind spot because many organizations are still trying to govern AI agents using tools and processes that were designed for human beings. Because an agent often occupies a strange middle ground between a user and a service account, it might sign into a system using a human’s login flow but then interact with a backend integration using a completely different set of credentials. This leads to a situation where 71% of organizations report significant gaps in visibility, meaning they literally cannot tell which agent is using which credential at any given moment. Even in companies that claim to be highly secure, about half still can’t accurately reconstruct the activity trail once an agent has crossed an access boundary. When you look at an audit log and see a human’s name attached to an action that a rogue agent took, you realize that our current evidence trail is not just incomplete—it’s potentially misleading.
When a breach occurs or a system is compromised by an agent, there seems to be a lot of finger-pointing regarding who is actually responsible. How is accountability currently being handled in the industry?
Accountability is currently in a state of absolute chaos, with no clear consensus on where the buck stops when an AI agent makes a catastrophic error. When we look at the data, the responses are scattered across team leads, individual users, and C-suite executives, yet 65% of people believe that the “current owner” shouldn’t be the one held responsible. The hard truth is that agents are not people—they have no legal agency and no way to answer for their actions—so the responsibility must be a shared burden between the user and the security team that built the guardrails. Reconstructing what happened is often impossible because the audit trail frequently points to a person who had no idea the agent was even active. Without a reliable way to distinguish between a person’s intentional click and an agent’s automated request, we are left in a position where we are assigning blame in the dark.
For leaders who are currently feeling overwhelmed by the speed of AI adoption, what are the most critical steps they can take to regain control of their identity security?
The first and most vital step is a complete discovery of every identity touching your systems, because you simply cannot govern an inventory that you don’t know exists. This means looking beyond the official IT-sanctioned apps and finding the service accounts, API keys, and local agents that are living in browsers and on developer endpoints. Second, you must move toward replacing “standing access” with “just-in-time” scoped grants, ensuring that an agent only has the permissions it needs for the duration of a single task. We also need to work toward a brokered authentication model where the agent never even sees the actual secret; instead, a trusted authority issues a short-lived token that expires almost immediately. Finally, building an audit trail that captures exactly who or what authorized an agent’s action is the only way to solve the attribution crisis and ensure that every automated move is traceable back to a human decision.
What is your forecast for the evolution of AI agent governance?
I believe we are heading toward a major reckoning where the “move fast and break things” mentality of AI deployment will hit a wall of mandatory, automated governance. Over the next few years, we will see a shift where identity is no longer just a perimeter check but a continuous, real-time verification of every single action an agent takes. We will likely move toward a world where “credential brokering” is the standard, and the idea of an agent having persistent access to a database will seem as antiquated and dangerous as leaving your front door unlocked in a crowded city. The organizations that thrive will be those that realize AI is not a separate entity to be managed later, but a core part of their identity fabric that requires the same—if not more—rigor than the human workforce. Ultimately, the goal is to reach a state where we can trust these agents to act on our behalf because the guardrails are so robust that the risk of a “hallucinated” security breach is effectively engineered out of the system.
