Three real breaches in the last thirteen months, three different industries, the same root cause: one long-lived credential wired into everything an agent touches. A deep dive into how AI agents actually get authenticated, the market now selling against this exact failure, and the guardrails that would have changed each outcome.
Start from documented incidents, not hypothetical risk. Check the pattern against current research. Then map both the market response and the guardrails that actually close the gap.
The Salesloft Drift OAuth token compromise (700+ downstream organizations), a four-year-old Salesforce credential that cascaded through roughly 200 companies via Klue, and a single unprotected maintenance credential that exposed 62 million PowerSchool students and 10 million teachers — three breaches, one pattern.
Cross-referenced against 2026 identity research: 69% of enterprises share AI agent credentials across workflows, non-human identities now outnumber humans by a composite ratio near 79:1 (144:1 in cloud-native environments), and GitGuardian logged 28.65 million hardcoded secrets added to public GitHub in 2025 alone.
Reviewed how the market is answering: a wave of purpose-built NHI vendors, a 2026 consolidation wave that shows how fast this category is being absorbed into core identity platforms, and the guardrail patterns — scoped issuance, short-lived credentials, lifecycle automation, behavioral monitoring — converging as the actual fix.
Both patterns get an agent talking to five systems. Only one of them keeps a single leaked credential from becoming five compromised systems.
Three documented breaches from the last thirteen months, at three different scales, all tracing back to the same design choice.
Aug 2025 · Salesloft Drift OAuth breach. A set of long-lived, broadly-trusted OAuth tokens, once compromised by the group tracked as UNC6395, gave attackers a path into 700+ downstream organizations' Salesforce environments — including Cloudflare, Google, PagerDuty, Palo Alto Networks, Proofpoint and Zscaler. The tokens were revoked only after the fact, on August 20.
2026 · Klue / Salesforce credential cascade. A four-year-old Salesforce credential, never rotated, was used to breach Klue and cascade into roughly 200 companies, including LastPass, Jamf and HackerOne.
PowerSchool breach. Attackers used a single unprotected maintenance credential — with no MFA in front of it — to access the data of 62 million students and nearly 10 million teachers.
Three incidents, three industries, one identical root cause: a credential built to be shared, not scoped — issued once, trusted everywhere, and never re-evaluated per connection.
Machine identities don't behave like the human accounts identity programs were designed around.
Credentials outlive the project, the vendor relationship, or the employee who created them. Non-human identities are seldom retired — the Klue credential was four years old when it was used.
The fastest scope to request is usually the broadest one available on the target system, and almost nobody revisits it once the integration is working.
Machine identities can't complete a second factor and don't have a session that expires on its own, so a stolen credential behaves like a permanent key rather than a temporary one.
Machine identities in the average enterprise grew roughly 5x between 2021 and 2025 — from about 50,000 to about 250,000 — far outpacing the humans who are supposed to own and review them.
A wave of purpose-built vendors emerged to discover, govern and secure non-human identities — and in 2026, the biggest identity and security platforms started buying their way in rather than building it themselves.
This category is consolidating fast. In 2026 alone: Cisco announced its intent to acquire Astrix (May), SailPoint closed its acquisition of Entro (June), and Cyera signed a letter of intent for Oasis (July, at roughly $1B). Non-human identity management is being absorbed into core identity platforms rather than staying a standalone product line — a strong signal that credential sharing has moved from "edge case" to "board-level line item" in about eighteen months.
Not "rotate keys more often." A credential-issuance discipline applied at the point a new agent integration is created.
Scope every credential to exactly the actions one integration needs, decided at creation time — not trimmed later, if ever.
Issue short-lived credentials per task or session instead of standing keys valid indefinitely. A credential with a shelf life measured in hours can't still be active four years later.
Trigger rotation and revocation automatically from identity lifecycle events — integration retired, vendor offboarded, agent decommissioned — instead of a manual ticket nobody files.
Flag a service account or agent touching a system it has never touched before, with a target of containing a compromised identity in under 24 hours rather than discovering it at the next audit.