Your AI agents can reach data no one approved
A credential expired. An AI agent kept using it anyway, and a mid-sized company’s systems went down for a quarter’s worth of trouble before anyone traced the failure back to a non-human account no one had been logging.
That agent could reach customer records, source code, and HR files the whole time. The tools that track who touches sensitive data were built for employees, and they lose the thread once a semiautonomous account starts opening doors on its own. The exposure lands on the company whose data the agent can reach.
1Password surveyed 1,000 security and engineering staff at large U.S. firms in late May and early June 2026. 46% of the developers run AI agents in production right now.
Agents are reaching data outside their approval
Agents at these companies can get to material that carries legal and competitive weight. 71% of respondents said their agents can reach sensitive information.
Access maps loosely to approval. At about four in ten organizations, agents reach data outside their approval. Across the survey, agents touched roughly twice as much data as anyone had signed off on. One person who runs IT operations at a mid-sized company knows the feeling firsthand.
“We had an AI agent pull data from the wrong system due to overly broad access permissions, which caused some inaccurate reporting that took us a while to track back to the source.”
Credentials that stay live too long
The credentials behind that access tend to linger. 40% of developers grant agents persistent access to systems and secrets, so the access stays live after the task ends. Add stale credentials to thin logging and a failure becomes hard to trace. A senior network administrator at a mid-sized company lived through exactly that.
“We had a major system outage last quarter because an AI agent was using an expired credential and nobody knew about it until things broke. Tracking it down took forever because our audit trails for non-human accounts are basically nonexistent right now, it was a mess.”
The habits feeding agents come from how developers handle their own secrets. About a quarter hardcode credentials into scripts or config files. Best practices for secrets management run slow, and companies want engineers shipping code on a tight clock. Jason Meller, VP of Product at 1Password, has watched this standoff play out for two decades.
“Security tools have spent twenty years asking people to slow down, and people have spent twenty years saying no. The lesson here isn’t that developers need more training. It’s that the secure thing has to become the easy thing, or it won’t happen at all.”
Untrusted content is steering agents
Untrusted content can hijack an agent mid-task. 47% of developers have had an agent take an unintended action after following instructions buried in a webpage, document, email, or tool output.
“This result is alarming, but it also tracks with our own independent research,” says Meller. “Our testing found that models are near-perfect at recognizing phishing, but recognition doesn’t make an agent stop in the middle of a task. Often the agent isn’t even being tricked into disobeying instructions, it’s just faithfully following a request that leads somewhere dangerous.”
The damage shows up in incident logs. Among developers who use agents, 33% said their company had a breach or security incident tied to overprivileged non-human identities. Close to three-quarters of developers reported some unintended consequence from agents, from inaccurate outputs to data leaks.
No one agrees who is responsible
Nobody agrees who answers for an agent’s actions. The survey asked who is held accountable when an agent causes harm, and the answers scattered across the org chart. 65% said a different person should carry the responsibility. Meller skips past the biggest numbers and lands on a small one.
“The number that gets me isn’t the 24% or the 19%. It’s the 5% who say the agent itself is accountable. An agent can’t be fired or sued. That answer means the conversation hasn’t happened yet,” he told Help Net Security.
Ask Meller where it belongs.
“Accountability should actually sit with whoever authorized the agent’s access. The person who decided this agent gets access to this system bears the responsibility for what it does with that access, regardless of who was typing the prompts. That framing is uncomfortable because it means access grants carry real moral weight. You can’t hand an agent the keys and then shrug when it drives somewhere you didn’t intend.”
1Password is building a credential broker that ties each credential issuance to a specific agent identity and to the person who authorized it.
Capability gains keep reopening the gap
Meller sees the sequence repeating with each capability jump. New abilities open fresh paths to systems no one flagged as a risk. Governance tends to arrive after the incident. He offers one marker for progress.
“The first sign to watch for is whether anyone consults security before deploying agents. Right now the pattern is deployment first, governance retrofit, incident, actual policy. When security is in the room during the scoping conversation rather than in the postmortem, that’s when organizations have turned a corner.”
Download: The ultimate guide to network operations management