Agent security is mostly a shared password problem, and no bundle fixes that

Seventeen out of 40. That is how many enterprises that say they enforce scoped AI agent permissions still let agents run on shared credentials, per a September survey of 102 companies. Call it 43%. Nearly half the teams with a policy are not following it.

Everyone is reading this week as the week agent security grew up. Microsoft shipped Guardian Agents. ServiceNow shipped a new name. The short version: the hard part of agent security is not a product you buy. It is a habit most teams do not have yet.

Look, I like what Microsoft built. Its new agent security stack starts every agent with no standing access and hands it only what one task needs, for as long as that task runs. Defender now spots 60 types of local agents, up from 25, including Claude Code, Codex and Microsoft's own GitHub Copilot.

Satya Nadella wrote that the most trustworthy system will be "the one that enables us to trust the model the least." I agree with every word. Then you see the price tag: the full stack is bundled into Microsoft 365 E7 at $99 per user per month.

Do the math. That is $1,188 per user per year. A 1,000-seat company is looking at about $1.19 million a year for the bundle. Some of you will get real value from that, but no license can stop your team from handing three agents the same API key.

Here's the thing. The survey on shared agent credentials is the real story of the week. Only 14 of 102 companies could revoke an agent's access within minutes.

Ten were not certain they could revoke every agent at all. Fourteen did not know. That is the state of the floor these shiny tools are supposed to stand on.

And it shows up in the incident numbers. In a June wave of 107 enterprises, companies that allowed credential sharing anywhere had incidents or near-misses at a 63.5% rate. Companies where every agent had its own scoped identity came in at 40.9%, so sharing carried roughly one and a half times the rate.

Funny enough, the fancy tools assume you already did the boring part. Risk scoring needs to know which agent did what, and if four agents share one service account, the score points at the account. Cobalt's CISO put it plainly: shared identity makes it "much harder to answer basic security questions."

This is where it gets fun. ServiceNow renamed its control tower to "Super Intelligence Control Tower" and launched AI Passport, an identity layer for agents. Field research from 15 customer interviews found it works well as a governance workflow tool, but has not broadly proven it can enforce controls at runtime across a mixed environment.

That is after more than $8.8 billion in acquisitions, with Veza at about $1.2 billion and Armis at about $7.6 billion. Shadow AI detection, the feature that finds agents you do not know about, has not shipped and is expected in Q4. A new name is not a new capability.

Meanwhile, the most useful security release of the week was free. Perplexity open-sourced its SPACE sandbox under Apache 2.0. Red-teamers made 108 attempts to break out and got zero escapes, and Perplexity says a shared-address exploit got past seven of nine commercial sandboxes it tested.

I'll be real: Perplexity ran those tests on its own product, and one red-team round is not a guarantee. Still, a free sandbox that keeps credentials outside the VM teaches the same lesson as the survey. Keep secrets away from the agent, and give each agent its own key.

So who wins? Vendors with solid identity plumbing, and buyers who do the cheap work first. Who pays? Teams that buy a premium bundle before they fix shared keys, because they risk paying top dollar for a dashboard that cannot tell their agents apart.

My test is simple. Pick any agent in production and ask two questions: can you name the one identity it runs on, and can you kill only that agent in under five minutes? If either answer is no, fix that before you sign anything. If both are yes, then go shop for guardian agents.

See you next week, geeks.