AI agents and other non-human identities are rapidly increasing in enterprise environments, outnumbering human users by as much as 50 to one. These identities often lack clear ownership, have inherited or excessive permissions, and persist beyond their intended lifecycle, creating significant identity security gaps. Traditional identity governance assumes human lifecycle events to manage access, but AI agents do not follow these patterns, leading to an expanded and poorly understood attack surface. A notable example includes a 2025 incident where a threat actor exploited a trusted OAuth token to move laterally across multiple organizations, demonstrating how trusted machine identities can be leveraged for attacks. Organizations with rapid AI-driven identity growth report higher breach rates despite stronger governance efforts, underscoring the need for continuous visibility, ownership accountability, and adapted identity governance frameworks to manage AI-related risks.

The growth of AI agents and machine identities expands the number of trusted credentials within enterprise environments, increasing the attack surface and the risk of unauthorized access. These identities can be exploited by attackers to move laterally and access sensitive data, as demonstrated by the 2025 incident involving OAuth token compromise. The lack of clear ownership and lifecycle management for these identities complicates governance and increases the likelihood of breaches. Organizations experiencing rapid AI-driven identity growth have reported a 43% breach rate over the previous year, significantly higher than organizations without such growth.

Patch status is not applicable as this is not a software vulnerability but a security governance challenge. Organizations should enhance identity governance to include non-human identities by maintaining continuous visibility into all identities, establishing clear ownership for each identity, regularly reviewing and revoking unnecessary permissions, and adapting lifecycle management processes to account for AI agents and machine identities. Implementing identity governance solutions that can track and manage AI-generated identities and their permissions is critical. No vendor advisory or official fix exists; mitigation relies on improved governance and monitoring practices.