When a new employee joins your company, you do not hand them a sticky note with someone else's password and tell them to get to work. You create an account. You decide what it can touch. You take it back when they leave. That ritual is so basic that no one thinks of it as security anymore. It is just how work starts.
Now count your AI agents. If any of them are running on a pasted API key, a teammate's login, or a shared service account, you have hired workers without identities, and you are in the majority. A June 2026 VentureBeat survey of 107 enterprises found that 69% of organizations admit to credential sharing somewhere in their agent fleet, and only 32% give every agent its own scoped, managed identity. The same survey found 54% have already had an AI agent security incident or a near-miss: 18% confirmed incidents, 36% caught before harm. VentureBeat gave the pattern a name that is likely to stick: the agent security gap.
This is the operational sequel to the governance gap we wrote about in June. Governance asks whether you can see what your agents did. Security asks a harder question: when something goes wrong, can you tell which agent did it, and can you shut that one down without breaking everything else? For most companies, today, the honest answer is no.
Why agents break the identity model
Every identity system in your company was designed around a quiet assumption: an account belongs to a person. One human, one login, one multi-factor prompt, one offboarding checklist when they leave. The entire apparatus, from password policies to access reviews, leans on that one-to-one mapping.
Agents violate every part of it. They are created in an afternoon, not hired through HR. There can be ten of them by Friday and forty by the end of the quarter. They act at machine speed, around the clock, without a phone to receive the MFA code (see what a 24/7 agent actually does). And nobody schedules an exit interview for a script.
So teams take the path of least resistance. They paste in an API key that already works. They let the agent run under the account of whoever built it. They point five agents at one service account because creating five felt like paperwork. None of this is negligence; it is the default behaviour of busy people using identity tools that were never built for a workforce that multiplies. The Cloud Security Alliance found the predictable result: 82% of enterprises say unknown AI agents are operating in their environments, and 53% have had agents exceed their intended permissions.
What a shared credential actually costs
A shared credential feels free right up until the moment it is not. Three failures arrive together:
| Without per-agent identity... | So this happens |
|---|---|
| No attribution | Five agents share one key, so when a record is deleted or a strange email goes out, the log says the key did it. Which agent? Incident response becomes guesswork. |
| No surgical revocation | The only way to stop one misbehaving agent is to kill the credential every agent depends on. You are choosing between an ongoing incident and a self-inflicted outage. |
| Unbounded blast radius | An agent tricked by a prompt injection inherits every permission on the shared key, not just the ones its job needed. The compromise of your least important agent carries the access of your most important one. |
The survey data puts a number on the difference. In environments with any credential sharing, 63.5% reported an incident or near-miss. Where every agent had its own scoped identity, the rate dropped to 40.9%. Identity is not a compliance nicety; it is the single control with the clearest measured effect on whether you end up writing an incident report. And yet only about three in ten organizations isolate or sandbox their highest-risk agents.
Governments have noticed
In May 2026, the Five Eyes cybersecurity agencies, including CISA, the NSA, the UK's NCSC, and the Canadian Centre for Cyber Security, published Careful Adoption of Agentic AI Services, the first coordinated multi-government security guidance aimed squarely at agentic AI. Its advice is strikingly consistent with the survey's findings: extend least privilege and zero trust to agents, give each agent a distinct, verifiable identity separate from human identities, assume agents will behave unexpectedly, and design for reversibility, the ability to undo what an agent did, not merely block it.
The guidance is non-binding, but that is not the point. It sets the expectation that regulators, insurers, and enterprise customers will reach for when they ask how your AI is controlled, the same way the audit-trail expectation crept from best practice into compliance reality. "Our agents all share an API key" is about to sound the way "our developers all share the root password" sounded in 2015.
The five-step fix
Closing the gap does not require a security department. It requires making the boring thing, one agent, one identity, the path of least resistance.
- Inventory every agent. You cannot scope what you cannot see, and if 82% of enterprises have unknown agents, assume you do too. One list: every agent, its job, its credentials, its owner.
- One agent, one identity. Every agent gets its own named account or key, owned by a person. The moment two agents share a credential, you have lost attribution, and attribution is what every other control depends on.
- Grant the minimum, expire the grant. Scope each identity to the tools its job requires, nothing more, and revisit the grant when the job changes. Most agents are over-permissioned because nobody ever looks twice.
- Sandbox the risky ones. An agent that reads the web and can act on your systems is your most dangerous employee. Isolate it, and assume anything it ingests may be hostile.
- Log everything, and keep the undo button. Every consequential action leaves a record tied to the agent that took it, and for the actions that matter most, prefer designs you can reverse over designs you can only regret.
Do this from the first agent and it costs minutes. Retrofit it onto a sprawl of shared keys and it costs a quarter.
Where Crewdle fits
The reason most companies fail at per-agent identity is that their agents live scattered across a dozen services, where the shared key is always the easy path. Crewdle makes the right path the default one:
- Every agent is somebody. In Crewdle Connect, an agent is created with a name, a role, and its own connections to tools. It is a first-class entity you can point at, not a script squatting on a human's login.
- Permissions are per-agent toggles. Crewdle Admin shows which agent can touch which tool, and granting or revoking access is a switch, not a key-rotation project. Stopping one agent does not break the others.
- The meter doubles as the audit trail. Because Crewdle is pay-as-you-go, every task is attributed to the agent that ran it, so the same screen that keeps spending under control answers the security question: which agent did what, and when.
- Your data stays yours. Conversations and content are never used to train AI models, which closes off a quieter identity risk: what your agents know leaking into someone else's.
The takeaway
The agent security gap is not a story about scary AI. It is a story about ordinary identity hygiene failing to keep up with a workforce that multiplies: 54% of enterprises already burned, two-thirds still sharing credentials, and the measured difference between the two postures sitting in plain sight, 63.5% versus 40.9%. The Five Eyes agencies have now said what the data was already saying: an agent that can act needs an identity that can be named, scoped, and revoked. Your first employee got a login before they got a task. Your agents deserve the same, and after this year, the people asking questions about your AI will expect it.
Start for free and give your first agent what every worker gets on day one: a name, a job, and its own set of keys.
Ask about this article 
