1. Executive summary
Okta's Enterprise AI Index, drawing on anonymised sign-on data from over 20,000 organisations (June 2022–June 2026), reveals that enterprise AI adoption has shifted from autocomplete and chat tools to autonomous agents that execute multi-step workflows across corporate systems. The core security failure: these agents are predominantly authenticated via legacy methods — service accounts, static API keys, and shared human logins — rather than dedicated non-human identities. When agents inherit human logins, the audit trail is destroyed: security teams cannot distinguish whether a critical action was taken by an employee or autonomously by an algorithm. As the number of AI platforms per organisation grows, so does the attack surface of over-permissioned apps and orphaned tokens. For EMEA financial services, this represents an unmonitored expansion of the identity fabric with direct implications for access governance, audit integrity, and privilege-abuse detection.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 17: ICT-related incident management process | AI agents acting under shared human logins destroy the audit trail, making it impossible to determine whether a critical action was taken by a person or an algorithm — directly undermining incident detection, classification, and response capability. | Clients cannot meet incident management process requirements if they cannot attribute actions to an actor during investigation. Review agent authentication now. |
| DORA Art. 28: ICT third-party risk — general principles | Each new AI platform introduces app-to-app connections built on secrets and tokens that reach into corporate knowledge; credentials scatter across multiple third-party vendor systems with no consolidated lifecycle management. | Clients must extend third-party risk assessments to cover the identity and credential sprawl created by AI vendor integrations, not just the vendor relationship itself. |
| NIS2 Art. 21(2)(d): supply chain security measures | Over 100 distinct AI products (consolidated into 74 vendor suites) are accessing enterprise systems via SSO, with credentials spreading across many systems as platform count grows — creating orphaned tokens and over-permissioned apps in the supply chain. | Clients need supply-chain security measures that specifically address machine-credential lifecycle for AI vendor integrations, including token revocation and access review. |
3. Technical analysis & attack chain
This is a systemic identity-governance exposure, not a single-vulnerability exploit. The attack surface is created by the authentication architecture enterprises have adopted for AI agents.
How the exposure works
- Platform proliferation. Organisations run multiple AI platforms simultaneously — coding assistants, writing tools, enterprise search, meeting AI, creative suites — from over 100 distinct products across 74 vendor suites. Each platform arrives with its own logins and permissions, distributed via corporate SSO.
- Credential sprawl. AI chat and agentic features reach into corporate knowledge through app-to-app links built on secrets and tokens. As platform count increases, credentials scatter across many systems. Okta's data shows a direct correlation between platform count and security exposure via over-permissioned apps and orphaned tokens.
- Legacy authentication for agents. Companies authorise agentic workflows using: - Traditional service accounts (broadly scoped, rarely rotated) - Static API keys (no lifecycle management) - Shared human logins (agents inherit a person's identity)
- Audit-trail destruction. When an agent runs under a human's account, every action the agent takes is indistinguishable from that human's actions in the audit log. A critical data access, workflow trigger, or system change cannot be attributed to the employee or the algorithm.
- Agent capability expansion. Since spring 2025, coding tools began running longer chains of work with less human prompting. Newer agent systems move through codebases and finish multi-step tasks autonomously — accessing data, triggering workflows, and taking action across enterprise systems. The blast radius of a compromised or misconfigured agent identity is therefore significantly larger than a chat-only tool.
- Shadow AI layer. A significant portion of AI use sits outside sanctioned tools, meaning personal accounts and unsanctioned services operate alongside corporate SSO-distributed tools.
Market context (corroborated by Okta data across 20,000+ organisations): AI-native vendors (Anthropic, OpenAI, Cursor) grew enterprise customer base >4x. Anthropic surpassed OpenAI in enterprise accounts in March 2026 and led in monthly active users the following month. Microsoft 365 remains ahead on raw volume. Established vendors (Google Workspace, Figma, Slack, Adobe, Notion) added AI features to existing customer bases.
Confidence caveat: The credential-sprawl and authentication-mechanism findings are drawn from Okta's anonymised telemetry and Okta researcher commentary (single-sourced). The CrowdStrike and BleepingComputer/Token Security sources corroborate the general pattern — that agentic AI identities are a recognised attack surface — but do not independently verify Okta's specific statistics. Treat the quantitative claims as single-sourced; verify against your own SSO and IAM telemetry before enforcement.
4. Mitigation & containment
P1 — Within 24 hours
- Inventory AI agent identities. Query your IdP (Okta, Entra ID, etc.) for all service accounts, API keys, and OAuth tokens associated with AI platforms. Identify any agent workflows running under shared human logins. Priority: any agent with access to financial data, transaction systems, or customer records.
- Block shared human logins for agent workflows. Where agents are using human credentials, suspend those workflows and migrate to dedicated service accounts with least-privilege scopes as an interim measure.
P2 — Within 72 hours
- Audit token sprawl. Enumerate all app-to-app connections (OAuth grants, API keys, service-account tokens) for every AI platform in use. Flag over-permissioned apps (scopes exceeding documented business need) and orphaned tokens (associated with deactivated users or deprecated workflows). Revoke orphaned tokens immediately.
- Identify shadow AI. Cross-reference SSO logs against the sanctioned AI tool list. Flag personal-account usage and unsanctioned AI services accessing corporate resources.
P3 — Within 7 days
- Implement dedicated non-human identities for agents. Each AI agent should carry its own identity with:
- Lifecycle management tied to real usage (creation, rotation, revocation)
- Least-privilege access scoped to the agent's documented function
- Access reviews on a defined cadence
- Answer Okta's three questions per agent: Where does it run? What can it connect to? What can it do? Document answers in your identity governance register.
- Establish agent-specific audit logging. Ensure agent actions are logged under the agent's own identity, not a human's, so the audit trail distinguishes human from algorithmic actions.
- Review AI vendor integrations under DORA Art. 28. Assess the identity and credential exposure of each AI vendor's app-to-app connections as part of third-party risk management.
5. Indicators of compromise
No indicators of compromise available in the source material.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| AI agent actions logged under a human user identity (indistinguishable from human activity) | IdP audit logs, SIEM — look for service-account or API-key activity attributed to a named human user | High (corroborated across sources) |
| Over-permissioned OAuth grants or API tokens for AI platforms with scopes exceeding business need | IdP OAuth/OIDC grant inventory, API gateway token logs | Medium (single-sourced to Okta telemetry) |
| Orphaned tokens associated with deactivated users or deprecated AI workflows still active | IdP token lifecycle logs, IAM access reviews | Medium (single-sourced to Okta researcher commentary) |
| Personal AI accounts accessing corporate resources alongside sanctioned SSO-distributed tools | SSO logs, CASB/DLP, egress proxy logs | Medium (single-sourced to Okta report) |
| Multi-step autonomous agent workflows executing with minimal human prompting across codebases or enterprise systems | Agent platform audit logs, EDR process telemetry, workflow engine logs | Medium (corroborated by CrowdStrike and BleepingComputer) |
6. Detection
Insufficient indicators to author detection rules.
The source material describes systemic identity-governance behaviours rather than specific malicious artefacts (strings, file paths, registry keys, command-line flags, or network signatures). Detection should be implemented as behavioural queries against your IdP and SIEM:
- Query for OAuth tokens or API keys assigned to AI platforms where the token owner is a human user, not a service principal.
- Alert on multi-step workflow executions originating from AI agent platforms where the authenticated identity is a named human account.
- Alert on new app-to-app connections from AI vendor platforms that request broad scopes (e.g., full mailbox access, repository write access, document management write access).
- Monitor for tokens associated with AI platforms that remain active after the sponsoring user's account is deactivated.
7. Sources
- Help Net Security — "AI agents are still logging in as humans" — https://www.helpnetsecurity.com/2026/07/21/report-enterprise-ai-identity-risk/ — 2026-07-21
- CrowdStrike — "The Identity Problem Hiding in AI Agent Deployments" — https://www.crowdstrike.com/en-us/blog/the-identity-problem-hiding-in-ai-agent-deployments/ — (date not specified in source)
- BleepingComputer — "Agentic AI Has an Identity Problem and Attackers Know It" — https://www.bleepingcomputer.com/news/security/agentic-ai-has-an-identity-problem-and-attackers-know-it/ — (date not specified in source)
8. Adverse Trace position
This is a high-severity systemic identity exposure for EMEA financial services. The core risk is not a specific CVE or actor — it is the uncontrolled expansion of the identity fabric through AI agent adoption, authenticated via legacy methods that destroy audit attribution. For regulated financial institutions, the inability to distinguish human from algorithmic action in audit logs is a direct control failure that undermines incident investigation, regulatory reporting, and access governance. The quantitative findings are single-sourced to Okta; clients should validate against their own IAM telemetry. We are treating this as a priority advisory because the exposure is already present in most large organisations, the agent capability set is expanding (multi-step autonomous workflows), and the regulatory obligations under DORA and NIS2 are clearly engaged. Next steps: we will publish a follow-up with a dedicated non-human identity architecture reference for AI agents in financial services environments.
Published via PulseTrace — Adverse Trace threat intelligence.