Analysis
The Replicant in Your Directory: AI Agents and the Identity Security Gap
Publication date not yet evaluated · Added · 2 reports bleepingcomputer.com
Page published
Coverage timeline
Why it matters
AI agents that automatically create and inherit credentials expand the trusted-identity attack surface faster than governance can track, giving attackers new pivot paths as illustrated by the UNC6395 OAuth token abuse.
A sponsored analysis piece by Netwrix CEO Grady Summers argues that AI agents, service accounts, OAuth apps, and other non-human identities now vastly outnumber human users and fall outside identity governance built for people. It cites the 2025 UNC6395 campaign, in which an OAuth token tied to Salesloft's Drift integration was abused to pivot across hundreds of Salesforce environments and reach AWS/Snowflake credentials, as an example of how a single trusted machine identity can cascade—an issue AI agents accelerate by creating and inheriting identities at machine speed.