Passwords became a security problem because they could be separated from the people they were meant to authenticate. Once shared or stolen, the same secret could be reused until someone detected the misuse and revoked the credential. Enterprises have spent years moving away from that model toward access tied more closely to the identity and context of the person making the request.
AI agents are introducing the same weakness into automated workflows, but at machine speed and across multiple systems. A credential granted for one legitimate task can remain active after the work ends, the agent’s purpose changes, or the person who authorized it moves to another role.
Unlike a conventional application following predefined instructions, an agent may decide which tools to call and what steps to take. Lingering access can therefore be used in ways the person who authorized it never anticipated.
Consider an agent authorized to assemble a customer renewal proposal. It may need temporary access to a CRM platform, pricing files, email, and a contract system. If those connections rely on reusable tokens or a standing service account, the agent could retain access after the proposal is complete.
A malicious instruction embedded in a document, a compromised tool, or a later workflow could then cause the agent to retrieve or transmit information unrelated to the original assignment.
