AI Agents Are Replicants in Your Directory — And Your Identity Governance Wasn't Built for Them
Machine identities outnumber human users up to 50:1 in enterprises. AI agents have no lifecycle governance, no offboarding, and 43% of orgs with expanded AI identity footprints get breached. Here's what to do about it.
Remember that scene in Blade Runner where Deckard runs a Voight-Kampff test on Rachael? She doesn’t know she’s a replicant. She’s been living in the system, indistinguishable from the humans around her, with access she shouldn’t have.
Now look at your IAM dashboard. That API key hitting your production database every 90 seconds? It was created by a Claude Code instance three months ago. Nobody onboarded it. Nobody owns it. And if it leaks, the blast radius includes everything that developer’s account could touch.
Welcome to the AI agent identity crisis.
The Numbers Are Worse Than You Think
Machine identities already outnumber human users by up to 50 to 1 in many enterprises, according to Netwrix’s 2026 Data and Identity Security Report. That’s not a forecast — it’s the current state of most AWS orgs, where service accounts, IAM roles, and API keys have been proliferating for a decade.
AI agents are supercharging this problem. A single developer running Claude Code spawns a dozen ephemeral tool-call sessions. Each one creates tokens, signs JWTs, or inherits OAuth scopes from the human’s account. Within a sprint cycle, you’ve doubled your identity footprint without anyone noticing.
The breach data confirms the urgency. Organizations where AI significantly expanded the identity footprint had a 43% incident rate — compared to 11% for orgs without that expansion. That’s nearly 4x higher, and it held true even when those orgs had stronger governance practices than their peers. Visibility alone isn’t defense.
Meanwhile, Beam.ai’s 2026 breach analysis found that 88% of organizations running AI agents reported a confirmed or suspected security incident in the past year — but only 6% of security budgets are allocated to AI agent security. And just 14.4% of agents go live with full security and IT sign-off.
The math doesn’t work. We’re deploying faster than we can govern.
Agents Don’t Have Lifecycles. That’s the Problem.
Human employees follow a lifecycle: onboard → role assignment → role changes → offboarding. Identity governance tools are built around this pattern. They expect hires, transfers, and terminations.
AI agents have none of that.
They’re self-creating. Claude Code generates a new API key, Cursor provisions a token for a remote MCP server, and none of it flows through your IGA tool. They inherit permissions from whoever spawned them. They persist long after the project that created them was deprecated. No offboarding. No rotation. No owner.
The UNC6395 incident documented by CRN’s 2026 AI security coverage illustrates the blast radius problem perfectly. A single trusted OAuth token — initially issued for what looked like a legitimate integration — was leveraged to pivot across hundreds of Salesforce orgs, ultimately reaching AWS credentials and Snowflake tokens. One agent’s over-permissioned identity became a skeleton key to the entire cloud estate.
Step Finance: $40M Gone Because Nobody Set a Limit
In June 2026, attackers compromised executive devices at Step Finance, a Solana DeFi platform. The firm’s AI trading agents had been configured with effectively unlimited permissions — they could sign any transaction, move any amount of SOL, with no human-in-the-loop for amounts over any threshold.
The attackers didn’t need a zero-day. They just needed to reach an agent that already had the keys to the kingdom.
Result: 261,000+ SOL drained. Roughly $27-30 million at the time. Only $4.7 million recovered. The STEP token crashed 97%. The company shut down.
This isn’t a crypto problem. It’s an identity governance problem that happens to have a crypto price tag. As the Beam.ai case study notes, 45.6% of DeFi teams use shared API keys for AI agents. No per-agent credentials. No transaction limits. No way to audit which agent did what.
The Detection Gap Nobody’s Talking About
Your SIEM was built to detect anomalous human behavior. Logins from unusual geolocations. File access at 3 AM by a marketing person who normally works 9-to-5.
AI agents don’t look like humans. They run API calls in rapid bursts. They access data programmatically. They authenticate through machine-to-machine flows that don’t generate the kind of audit events your SOC analysts are trained to investigate.
This is the identity detection gap. If your tooling can’t distinguish between a developer with a laptop and an AI agent running autonomously on a headless server, you’re blind to an entire class of threats.
The BleepingComputer analysis frames it bluntly: “Every new AI deployment quietly expands the number of trusted identities operating inside the environment. When an AI agent contributes to a security incident, who owns that identity?”
Most orgs can’t answer that question. Because they’ve never asked it.
Four Questions Every Org Needs to Answer
The fix isn’t another dashboard. It starts with governance design — the human work that has to happen before automation can take over.
1. What agent identities exist?
You can’t govern what you can’t see. Run a discovery process that maps every service account, API key, token, and OAuth grant that was created by or for an AI agent. Start with your cloud IAM, then expand to SaaS integrations, CI/CD pipelines, and internal tooling.
2. Who owns each one?
No orphan identities. Every agent credential needs a named human who’s accountable for its lifecycle: creation, permission review, rotation, and retirement. If nobody will claim it, revoke it.
3. What can each agent actually access?
Least privilege, applied immediately. Most agents inherit the full permission set of whoever spawned them. That’s the default that killed Step Finance. Agents should be scoped to exactly the resources they need — and nothing else.
4. When should these identities stop existing?
Set expiration dates on every agent credential. Automate revocation when a project ends or an agent hasn’t been used in X days. Machine identities should have shorter TTLs than human accounts, not longer ones.
Why Automated Tools Aren’t the Whole Answer
Yes, there are tools. The CRN list of 10 hottest AI security startups of 2026 includes eight runtime protection and observability platforms. Straiker and Pillar Security both offer pre-deployment adversarial testing. These are valuable — but they’re Layers 1-5 in a six-layer security stack.
What automated tools can’t do is the governance design. They can enforce policies, but they can’t decide what the policies should be for your specific environment. They can detect anomalies, but they can’t evaluate whether an agent’s permission set makes architectural sense given your threat model.
That’s the Layer 6 work dotfm focuses on: the human-led audit that maps your real attack surface, identifies the identity gaps, and builds governance that scales. Before the automation. Before the incident.
The Takeaway
Your identity directory is no longer just people. It’s people, service accounts, bots, scripts, and now — AI agents that self-provision, self-authorize, and never offboard.
The 4x breach-rate gap between orgs with and without AI identity sprawl isn’t theoretical. Step Finance isn’t a hypothetical. And the replication is accelerating.
At dotfm, we audit AI agent deployments end-to-end: code quality, prompt injection surfaces, supply chain risks, and identity governance. Because an agent that’s perfectly secure in isolation can still drain $40M if it has the wrong permissions.
Get in touch if you want to find out how many replicants are in your directory.
Is your AI-built app ready for real users?
We audit, harden, and ship AI-built apps. From security review to production deployment.
Get an audit