The AI Agent in Your Stack Is a Privileged User. Most Small Companies Have No Way to Govern It

Summary: Palo Alto Networks' 2026 Identity Security Landscape, drawn from a survey of more than 2,900 cybersecurity decision-makers, puts machine identities at 109 for every human, and 96% of respondents said human identities operate with access beyond what their roles require. GitGuardian's State of Secrets Sprawl 2026 recorded 28.65 million new hardcoded secrets in public GitHub commits during 2025, a 34% single-year rise, plus 24,008 unique secrets exposed in MCP configuration files and 64% of valid secrets from 2022 still active.
Bottom line: If access has not been right-sized for named employees who sit in an HR system and leave on a termination date, the article argues the prospect of right-sizing it for autonomous software is remote - and a bot's access key frequently outlives the project that justified it, holding permissions no one revisits.

Read the original at The Hacker News ↗