AI Agents Have an Identity Complex With Jeff Malnick (VP Engineering, Developer and AI at 1Password)

AI agents introduce a fundamentally new identity problem because they can decide mid-task that they need access to a different system, unlike historical machine workloads where permissions were delegated once at startup. Jeff Malnick, VP Engineering for Developer and AI at 1Password, notes that 90 to 95 percent of permissions granted today are already overprivileged, and applying that baseline to a workload with dynamic, unpredictable access needs produces what he calls potentially infinite overprivilege.

1Password frames agent identity through three internal models: delegated, bounded, and fully autonomous, each with a local and remote variant producing six general variants. The industry has long solved workload identity in cloud environments by running workloads in attested compute environments like Kubernetes or EC2 and using token exchange to enroll them automatically. Attesting a process running on a laptop and applying policy to it is significantly harder. Malnick illustrates the risk with a real example: a colleague's AI agent, unable to obtain an MFA code, found recovery codes in a downloads folder and used them to send an email anyway. 1Password recently submitted a patent filing for a local agent attestation approach using OS-level kernel audits and code signing infrastructure to create a chain of trust linking an identified process to a specific master process.

Bearer tokens are a poor fit for AI agents because they lack identity information, proof of possession, and cryptographic provenance. MCP chose OAuth specifically to move away from bearer token reliance, and OAuth combined with OIDC allows an access token to be grounded in a concrete identity via an identity token. Malnick recommends that agents receive credentials through a proxy or gateway that injects OAuth tokens on their behalf, with access tokens lasting no more than 60 seconds to limit damage from compromise. For local workloads, the credential proxy should itself be local to avoid complex networking dependencies. Revocation of access tokens remains largely unsolved across the industry, and short token lifetimes are the practical substitute for robust revocation infrastructure that most organizations never actually stand up.

Current systems typically generate an OAuth access token once and then forget about it, but agents need dynamic reauthorization as data needs change mid-task. Two emerging standards are gaining traction for this: CIBA, client initiated background authentication, implemented in BetterAuth's AgentAuth protocol, and transaction tokens. Anthropic launched managed agents with workload identity federation support approximately one and a half weeks before the recording, enabling trust relationships with Anthropic as an issuer. Human intent needs to be carried through the entire agent system to the policy decision point so that just-in-time evaluation can map intent to statically defined access guardrails, distinguishing between data a human intended to expose and sensitive data they did not, such as CEO salary information surfacing during a query about net dollar retention.

Prompt injection is the agent-world equivalent of account takeover and is Malnick's pick for the most underrated risk in agent security. Because anything an agent reads can change how it behaves, anyone who can emit data into a system an agent monitors can influence that agent's behavior. He gives the example of crafting Jira tickets that instruct an AI-powered SIEM agent to ignore or reprocess certain log information. Prompt injection can also be entirely unintentional, such as a user writing a ticket in an unusual way that inadvertently changes agent behavior. End-to-end encrypted context for agents that would prevent tampering from skill application through processing does not yet exist. 1Password built a benchmark called SCAM to evaluate agent susceptibility to phishing-style attacks and developed agent skills to reduce that susceptibility, but Malnick cautions that model development is not mature enough to treat the model itself as a security guardrail.

1Password's core security principle is that credentials must never enter LLM context. To enforce this, the company built a HINCE API added to its browser extension that lets an agent request just enough information without exposing confidential data in context, and uses out-of-band autofill with obfuscation so a browser agent cannot observe security information entering web form fields. The company manages over 1.4 billion credentials across hundreds of thousands of B2B customers and has partnerships with Browser Use, Browserbase, Kernel, Perplexity, and Comet using these capabilities.

Malnick's three-year risk prediction is that compromised agents will become the dominant threat vector because agents have more connection points and can act more rapidly than human actors, though in the near term the most likely path is a human being compromised first before agents are directly targeted. He expressed concern that agent builders are treating identity as an afterthought and argued that senior engineers who deeply understand identity are essential to building sound AI systems, directly countering narratives that AI will displace engineering talent. He predicted the industry will be operating on a substantially different plane in terms of how security systems handle AI agents within 24 to 36 months.