Analysis · curated 10 Jul 2026
The Replicant in Your Directory: AI Agents and the Identity Security Gap
First reported bleepingcomputer.com
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
AI agents that automatically create and inherit credentials expand the trusted-identity attack surface faster than governance can track, giving attackers new pivot paths as illustrated by the UNC6395 OAuth token abuse.
A sponsored analysis piece by Netwrix CEO Grady Summers argues that AI agents, service accounts, OAuth apps, and other non-human identities now vastly outnumber human users and fall outside identity governance built for people. It cites the 2025 UNC6395 campaign, in which an OAuth token tied to Salesloft's Drift integration was abused to pivot across hundreds of Salesforce environments and reach AWS/Snowflake credentials, as an example of how a single trusted machine identity can cascade—an issue AI agents accelerate by creating and inheriting identities at machine speed.