AI agents are still logging in as humans
Most large companies run more than one AI platform at the same time. Developers pull up coding assistants, marketing teams lean on writing tools, and analysts query enterprise search across separate vendors. Single-provider setups keep giving way to mixed stacks as companies keep their options open.
Sanctioned tools and personal accounts sit side by side inside many organizations. Anonymized sign-on data from more than 20,000 organizations on the Okta tracked this spread from June 2022 through June 2026. Each new tool arrives with its own set of logins and permissions.
The index draws on sanctioned applications that reach users through corporate single sign-on. The research team tracked over a hundred distinct AI products and consolidated them into 74 vendor suites, sorted across categories that span foundational models, developer tooling, enterprise search, collaboration and productivity, meeting AI, and creative suites.
A two-speed market
The Okta Enterprise AI Index sorts vendors into two groups by how fast their enterprise customer base grew across the study period. AI-native companies such as Anthropic, OpenAI, and Cursor multiplied their corporate customers by more than four times.
A data-driven cutoff separated the two clusters. Established software makers such as Microsoft, Google Workspace, Figma, Slack, Adobe, and Notion grew under that mark and took the AI-enhanced label. Both groups gained ground. Startups won new use cases, and incumbents added AI features for the customers they already had.
From chat to action
The kind of AI landing in these companies changed along the way. Early tools completed code and answered questions. The three phases trace a move from autocomplete to chat to agents. The shift toward agents gathered force in spring 2025, when coding tools began running longer chains of work with less human prompting.
Newer systems move through codebases and finish multi-step tasks on their own. Anthropic passed OpenAI in enterprise accounts in March 2026 and led it in monthly active users the following month. Microsoft 365 still sits far ahead on raw volume, with Anthropic reaching under half of its enterprise account total.
Credentials scatter as vendors add up
Every added platform brings its own connections. AI chat and agentic features reach into corporate knowledge through app-to-app links built on secrets and tokens, and those credentials spread across many systems. The count of platforms and the security exposure rise together.
“Our data shows that as the number of platforms grows, so does the risk of over-permissioned apps and orphaned tokens,” Fei Liu, Principal Emerging Tech Researcher at Okta, told Help Net Security. She calls for a change in mindset: “Security teams need to stop thinking about this merely as ‘adding a new software vendor’ and start treating it as an expansion of their identity fabric.” Least-privilege access and a lifecycle tied to real usage keep each grant in check.
Agents borrowing human logins
Credentials for AI agents come mostly from older methods. Companies lean on service accounts, static API keys, and, in some cases, shared human logins to authorize agent workflows. “We’re seeing a heavy reliance on traditional service accounts and static API keys, and unfortunately, we still see instances of shared human logins being used to authorize agentic workflows,” Liu said.
The audit trail suffers when an agent runs under a person’s account. “When an AI agent inherits a human’s login, you completely lose your audit trail — you can no longer distinguish whether a critical action was taken by an employee or autonomously by an algorithm,” she said. Okta’s guidance puts three questions to every agent: where it runs, what it can connect to, and what it can do. Demand is rising for dedicated non-human identities that carry their own lifecycle management and access reviews.
The shadow AI layer
A large share of AI use sits outside the sanctioned tools measured by the index. Employees spin up their own instances in personal cloud environments or reach unsanctioned models through personal accounts. “For every enterprise-grade AI tool provisioned by IT, there are inevitably pockets of developers or marketing teams spinning up separate instances in their own cloud environments or using personal accounts,” Liu said.
By her account, this shadow layer runs larger than the sanctioned footprint. The risk centers on data movement. “If an employee uses a personal account to access an unsanctioned LLM, and pastes proprietary source code or customer data into the prompt, the security team has zero visibility and no ability to revoke that access,” she said.
A single identity layer sits at the center of the response. Companies should “provide ‘paved roads’ to bring the most requested AI tools into the SSO and governance fold so employees don’t feel forced to bypass IT in the first place,” Liu said. More vendors, more agents, and more credentials raise the value of one place to grant, review, and revoke access across every platform in use.