The rapid adoption of AI agents in enterprise environments has introduced a new class of security risks that traditional governance models are ill-equipped to handle. A recent survey conducted by 1Password among 1,000 security and engineering staff at large U.S. firms in late May and early June 2026 highlights systemic failures in access control, credential management, and accountability for non-human identities.
According to the survey, 46% of developers are already running AI agents in production. These agents, designed to automate tasks and interact with various systems, have access to vast amounts of data—often beyond what was officially approved. 71% of respondents reported that their agents can reach sensitive information, including customer records, source code, and HR files. At about four in ten organizations, agents access data that falls outside their designated approval scope, and on average, agents touch roughly twice as much data as anyone had authorized.
The consequences of this overreach are tangible. One IT operations professional recounted an incident where an agent pulled data from the wrong system due to overly broad access permissions, leading to inaccurate reporting that took weeks to trace. Another senior network administrator described a major system outage caused by an AI agent using an expired credential, a failure that went undetected because audit trails for non-human accounts were virtually nonexistent.
The credential management practices behind these incidents are alarming. 40% of developers grant agents persistent access to systems and secrets, meaning the access remains active long after the specific task concludes. This creates a window of vulnerability where stale credentials can be exploited or misused. The problem is compounded by poor secrets management among developers themselves: about a quarter hardcode credentials into scripts or config files, a practice that security teams have warned against for decades but that persists under tight development deadlines.
Jason Meller, VP of Product at 1Password, notes that security tools have historically asked people to slow down, while developers have consistently pushed back. The lesson, he says, is that security must be made easy, not just enforced through training. The survey also reveals that untrusted content can hijack agents mid-task. 47% of developers have observed an agent taking an unintended action after following instructions embedded in a webpage, document, email, or tool output. This phenomenon, often called prompt injection or indirect prompt manipulation, exploits the agent's tendency to faithfully follow instructions without evaluating the source's trustworthiness.
Meller explains that while models may be near-perfect at recognizing phishing attacks, recognition does not stop an agent from executing a dangerous request. The agent is not being tricked into disobeying; it is following a request that leads to a harmful outcome. Among developers who use agents, 33% reported that their company experienced a breach or security incident tied to overprivileged non-human identities. Nearly three-quarters said they have seen some unintended consequence, ranging from inaccurate outputs to data leaks.
The accountability vacuum is another critical issue. The survey asked who is held accountable when an agent causes harm, and the answers varied widely across the org chart. 65% of respondents indicated that a different person should bear the responsibility. Notably, 5% said the agent itself is accountable—a finding that Meller finds particularly telling, as an agent cannot be fired or sued. He argues that accountability should rest with whoever authorized the agent's access, as that person bears moral weight for the agent's actions.
1Password is developing a credential broker that ties each credential issuance to a specific agent identity and the person who authorized it, aiming to close the gap between deployment and governance. Meller observes that this pattern repeats with each capability jump in AI: new abilities open access to systems that were never flagged as risky, and governance typically arrives only after an incident occurs. He suggests that a key indicator of progress is whether security teams are consulted before agents are deployed, rather than after an incident forces a policy change.
The survey underscores a fundamental mismatch between the speed of AI adoption and the slow evolution of security practices. As agents become more autonomous and capable, the risks of unauthorized data access, persistent credentials, and lack of accountability will only grow. Organizations must rethink their approach to non-human identities, implement robust credential management, and establish clear lines of responsibility before the next agent-caused incident spirals into a full-blown data breach.
Source: Help Net Security News