Forty-four years after the cinematic vision of replicants walking among us, enterprises are grappling with their own non-human workforce. These 'replicants' — AI agents, service accounts, OAuth applications, and other machine identities — already possess accounts, permissions, and access to sensitive data within our digital directories. The critical challenge? Our existing identity security frameworks were fundamentally built for people, exposing a rapidly widening gap.
What Happened
The landscape of enterprise identities has shifted dramatically. According to the Non-Human Identity Management Group, machine identities now outnumber human users by as much as 50 to one in many organizational environments. Unlike people, machine identities don't follow a predictable lifecycle of joining, changing roles, or leaving. Many are created for brief tasks and then forgotten, persisting with active permissions long after their original purpose has expired. This creates a vast, unmanaged population of credentials.
This isn't a theoretical threat. In 2025, a threat actor tracked as UNC6395 exploited an OAuth token associated with Salesloft's Drift chat integration. The token wasn't dangerous due to a software vulnerability; it was dangerous because it was trusted. From this single trusted machine identity, attackers pivoted through Salesforce environments across hundreds of organizations, gaining access to AWS credentials, Snowflake tokens, and other sensitive secrets.
AI agents don't create this underlying problem, but they drastically accelerate it. As organizations deploy AI agents, these entities begin to autonomously create new identities, inherit permissions, interact across diverse systems, and expand the number of trusted credentials operating within the environment. If security teams lack visibility into these identities or their capabilities, the enterprise attack surface grows quietly and exponentially in the background.
Cyberpunk image: image omitted due to site embedding policy; open the original article (BleepingComputer) (opens in a new tab) to view it. Photo/source: BleepingComputer (opens in a new tab)
Why It Matters
For developers, IT operations, and security teams, this burgeoning issue presents a significant challenge. Traditional identity programs are predicated on human ownership, periodic access reviews, and eventual revocation. AI agents, however, defy this model. They can be automatically provisioned, inherit permissions from parent identities, and interact with systems at machine speed, often creating additional identities as part of their operational workflow.
This means:
- Exploding Attack Surface: Every unmanaged or over-permissioned machine identity is a potential entry point for attackers. AI agents, with their ability to rapidly generate and utilize identities, amplify this risk, making it harder to track and secure all access vectors.
- Governance Overwhelm: Existing Identity Governance and Administration (IGA) tools and processes are ill-equipped to handle the scale and ephemeral nature of many machine identities. The identity population grows far faster than manual or semi-automated governance processes can manage, leading to 'ghost' identities with extensive, unmonitored access.
- Supply Chain and Lateral Movement Risk: As seen with UNC6395, a single compromised machine identity can become a highly trusted pivot point, allowing attackers to move laterally across cloud environments, SaaS applications, and internal infrastructure without triggering traditional alerts.
- Cloud and DevOps Complexity: The adoption of cloud-native architectures, microservices, and rapid DevOps pipelines further exacerbates this, as temporary credentials and service accounts are spun up and down at speed, often without robust, integrated lifecycle management.
AI isn't introducing a new identity problem, but it's shining a harsh spotlight on an existing one and supercharging its potential for exploitation. The principle that 'trust scales faster than governance' becomes acutely evident when autonomous agents are generating and consuming credentials across the enterprise.
What To Watch
Organizations need to urgently adapt their identity security strategies to encompass non-human identities. Key areas to focus on include:
- Discovery and Inventory: Gaining comprehensive visibility into all machine identities – who owns them, why they exist, and what permissions they hold – is the foundational first step. This includes not just service accounts but also API keys, OAuth tokens, workload identities, and especially AI-generated credentials.
- Lifecycle Management for Machines: Developing automated processes for provisioning, managing, and de-provisioning machine identities based on their actual lifecycle, rather than human-centric models. This requires understanding the purpose and lifespan of each non-human entity.
- Principle of Least Privilege: Strictly enforcing the principle of least privilege for all machine identities. Regular, automated audits of permissions are crucial to ensure that identities only have the access they absolutely need, for the duration they need it.
- Behavioral Analytics for Machines: Implementing security tools that can monitor the behavior of machine identities for anomalies, as they may exhibit different patterns than human users. This can help detect unauthorized activity even when legitimate credentials are used.
- Secure AI Deployment Practices: Integrating identity and access management considerations into the AI development and deployment pipeline from the outset, ensuring that AI agents are provisioned securely and their access is continuously monitored and governed.
The future of enterprise security hinges on our ability to govern these digital 'replicants.' Failing to address this growing gap will inevitably lead to more incidents like UNC6395, where trusted machine identities become the path of least resistance for sophisticated attackers.