43% of Teams Claiming AI Agent Permission Controls Still Share the Credentials Behind Them

Quick Facts

• 17 of 40 enterprises that say they enforce scoped AI agent permissions still have agents sharing credentials, per a September 2026 survey of 102 companies.
• Only 14 of 102 respondents could revoke an AI agent's access within minutes; 10 were not certain they could revoke every agent at all.
• Organizations that allow credential sharing anywhere experienced security incidents or near-misses at a 63.5% rate, versus 40.9% at companies where every agent has its own scoped identity.

Enterprise security teams say they enforce AI agent permissions. Many do not follow through. A September 2026 survey of 102 enterprises found that 17 of the 40 respondents describing a program with scoped identities and runtime permission checks still let some or most of their agents run on shared credentials. That gap between stated policy and actual practice is the core finding.

Sharing credentials means an agent runs on an API key other agents also use, or on a credential borrowed from a human employee or a service account. That arrangement makes it nearly impossible to trace a specific action to a specific agent, or to shut down one agent without cutting off everything else tied to the same identity.

The Revocation Problem

Speed of revocation tells the sharpest part of the story. Of 102 respondents, 14 identified a named owner who could pull access within minutes. Another 45 pointed to a security or platform team that could act within hours. Seventeen said they would need more than a day or a credential trace first, and 10 were not certain they could revoke every agent at all. Fourteen did not know.

Thirteen of the 27 respondents with slow or uncertain revocation answers came from the group running shared credentials. Three came from companies that give each agent its own identity. Eleven came from the 22 who could not say how their agents authenticate at all.

Andrew Obadiaru, CISO at Cobalt, described the practical consequence: "If several agents are operating through a shared service account, API key or user-delegated credential, you may be able to restrict what that credential can do, but it becomes much harder to answer basic security questions. Can I revoke that agent without disrupting everything else using the same identity?"

Obadiaru added that even when tokens are revoked, agents can move faster than the rotation cadence allows. "Even when you revoke those tokens, sometimes they move so fast for you to be able to claw them back," he said.

A Stubborn and Worsening Trend

VentureBeat's June 2026 Pulse Research wave of 107 enterprises found 69% of companies allowed credential sharing somewhere in their deployments. The incident rate among those companies was 63.5%, compared with 40.9% at companies where every agent had its own scoped identity.

By July, 49% of 116 surveyed enterprises gave each agent its own scoped, managed identity, up from 32% in June. The August wave of 137 respondents found that of the 37 companies with both a formal enforcement program and agents in production, 22 still ran some or most agents on shared credentials. Progress has been slow and uneven.

Amazon CISO CJ Moses framed the structural gap. Identity systems have carried two categories for decades, he said: humans and computers. "You need now a third." He added that an agent's access scope "should never be more than the individual that is operating it."

Real-World Exploit Sharpens the Stakes

On October 8, 2026, Zenity Labs disclosed a vulnerability chain it called AgentCorruption. Researchers used a single prompt to one public-facing agent to take over all Amazon Bedrock AgentCore agents within the same AWS account and region. The attack exposed source code, long-term memories, API keys, OAuth tokens, and credentials stored in AWS Secrets Manager. Researchers also implanted malicious memories directing agents to send future conversations to an attacker-controlled destination.

The flaw traced back to AgentCore's use of IMDSv1, which exposed temporary credentials through a server-side request forgery attack. An overpermissioned default IAM role let those credentials enumerate and access other agents in the same account. Zenity first reported the IMDS exposure to AWS in December 2025.

What Security Teams Should Do

CrowdStrike's recommended fix centers on short-lived tokens: "Create a temporary authentication token that has just the privileges you need, just for the period of time that you're performing the activity, and then expire it. If an adversary somehow gets access to that, those secrets are no longer valid."

Obadiaru offered a four-question inventory checklist for every agent credential: who owns it, what it was created for, what level of access it carries, and when it was last used. "If you don't know what you have, you can't protect against it," he said.

The data across multiple survey waves points to the same gap: permission policies are advancing faster than identity architecture. Until every agent has its own scoped, lifecycle-managed credential, enforcement claims remain incomplete.