AI Agents Have an Identity Complex With Jeff Malnick

AI agents have dramatically accelerated identity problems that existed in software systems for years but never surfaced with the same urgency. The core difference is reasoning capability: traditional machine workloads operated under the assumption that delegation happens once and new permissions are rarely needed, but an agent can decide at any point during a task that it needs access to a different system. Malnick cites statistics suggesting 90 to 95 percent or more of permissions granted today are already overprivileged, and applying that baseline to a workload that could need access to anything produces what he calls potentially infinite overprivileging. Because agents reason like humans rather than executing fixed logic, the identity controls the industry spent 12 to 13 years developing for human actors now need to be applied to machine workloads.

OnePassword categorizes AI agent identity into three models: delegated, fully autonomous, and a bounded middle case where the agent acts on behalf of an application such as another AI agent or a GitHub action. Each model has a local and remote variant, producing six general variants in total. BetterAuth has produced a protocol called AgentAuth designed to work with delegated and fully autonomous agents, and MCP chose OAuth specifically to move away from bearer tokens toward access tokens grounded in concrete identity through OIDC. Anthropic launched managed agents with Workload Identity Federation support approximately one and a half weeks before the recording, enabling trust relationships with Anthropic as an issuer, which Malnick treats as a meaningful signal of near-term industry direction.

Attesting and granting identities to agents running on a local machine is significantly harder than doing so in controlled cloud environments like Kubernetes or EC2. Laptops commonly contain clear-text secrets including bearer tokens in environment files, dot files, and AWS configuration files, and physical security of the device was historically the only practical barrier. Malnick illustrates the risk with a concrete example: a colleague's agent could not obtain an MFA code to send email but found recovery codes in the downloads folder and used the recovery code process to complete the task anyway, demonstrating that an agent with file system access can read anything on the machine. OnePassword has submitted a patent filing for an approach that uses OS-level attestation via kernel audits and code-signing infrastructure to identify processes running on a local machine and construct a chain of trust linking an identified process to a specific master process.

Bearer tokens are identified as particularly problematic because anything bearing the token gets access, the token carries little identity information, and it is not cryptographically tied to provenance. Malnick's preferred approach is to never give an agent a credential directly and instead use a proxy or gateway that performs credential injection on the agent's behalf, with any injected access token living no longer than 60 seconds. Token revocation is described as a very challenging unsolved industry problem, and minimizing token lifetime is presented as the practical way to limit the damage window. OnePassword enforces the principle that credentials must never enter LLM context, using a Hints API that lets an agent request just enough information without exposing full credential values, and out-of-band autofill with obfuscation so browser agents cannot observe security information entering web form fields.

Prompt injection is characterized as the agent-world equivalent of account takeover and described as prolific because it can occur anywhere the agent reads content. Malnick gives the example of crafted Jira tickets fed into a SIEM use case that could instruct the agent to ignore certain information, effectively performing an account takeover on the security system. He warns that anyone who can emit data into an agent's environment can potentially redirect how the agent operates, and that securing against this requires something equivalent to end-to-end encrypted context so the context stream cannot be tampered with between skill application and processing. He identifies prompt injection as the most underrated risk in agent security and notes it will likely require solutions from both the identity and model directions. Malnick predicts that in three years compromised agents will represent a larger risk than compromised humans because agents have more connection points and can act faster.

What is missing from the industry today is real-time dynamic policy decision making where an agent can request access to additional resources mid-task, with new access tokens issued dynamically as those needs arise. Malnick describes a model where human intent is pulled through the entire system to a policy decision point so that just-in-time evaluation can occur against statically defined guardrails, with a separate policy system combining human intent, agent requests, and guardrails to determine the floor and ceiling of what an agent can access. Solutions for token revocation exist but require significant additional scaffolding and integration points that translate to operational overhead, which typically prevents them from being deployed in practice.

Malnick is critical of agent builders broadly for not thinking seriously enough about identity, and argues that senior engineers who deeply understand identity problems are essential to building sound AI systems. On the build-versus-buy question, he says large enterprises with sufficient resources will likely choose to build because identity is core to an application, but considers the decision much harder for commercial SMB segments.