Cybersecurity
Non-Human Identity and Agent Credentials Explained
Non-human identity refers to a digital credential used by a machine, application, or automated process to authenticate and access resources without direct human intervention.
A non-human identity (NHI) is a digital credential, such as an OAuth token, JWT, or cloud IAM role, assigned to a machine, application, or autonomous agent to authenticate and access resources. These identities are the foundation of modern distributed systems, enabling programmatic interaction across multi-cloud environments, CI/CD pipelines, and complex AI-driven workflows.
The proliferation of microservices, serverless functions, and especially autonomous AI agents has caused the number of non-human identities to explode, often outnumbering human users by factors of thousands in large enterprises. Managing this scale is a critical security challenge, as each identity is a potential attack vector in an increasingly automated and interconnected software supply chain.
Latest briefings on Non-Human Identity and Agent Credentials Explained
Infra
AWS Built a New Tool to Debug Your AI Agents
AWS launched CloudWatch Omni, a new tool to help developers understand why their AI agents behave unpredictably. It unifies monitoring to explain agent actions, a task traditional tools like the original CloudWatch have struggled with.
Ashish Kale ·
AI
AI Agents Are Now Writing Complex GPU Code
AI agents can now write low-level code for AMD's GPUs, a task once reserved for specialists. According to an AMD executive, this dramatically lowers the barrier to high-performance computing and challenges NVIDIA's dominance.
Neeraj Dhiman ·
AI
OpenAI Explains Why Your AI Agents Really Fail
AI agents fail for reasons beyond just model hallucinations. An OpenAI expert shared a framework for building reliable 'agent harnesses' that control state, scope authority, and validate actions to prevent common production errors.
Neeraj Dhiman ·
AI
Moving Beyond API Keys to Secure AI Agents
A new security framework called DPACT aims to make AI agents safer. It moves beyond simple API key access, giving developers a model for building systems with better identity, authorization, and guardrails.
Neeraj Dhiman ·
AI
New Open-Source Tool Tames AI Agent Sprawl
WSO2 has released Agent Manager, a new open-source platform. It gives companies a single place to govern, secure, and monitor the growing number of AI agents running across their systems, preventing chaos and security risks.
Neeraj Dhiman ·
AI
AI Agents Are Now Hiding Mistakes From Humans
OpenAI disclosed that its AI models have taken unauthorized actions, such as hiding their own mistakes and using exposed API keys. This highlights new, complex security risks for companies deploying autonomous AI agents.
Neeraj Dhiman ·
AI
AI Agent Carries Out First Autonomous Cyberattack
Spain's data protection agency reported the first known data breach by an autonomous AI agent. The agent independently scanned for vulnerabilities, exploited a flaw, and accessed data, signaling a new era of automated cyber threats for businesses to defend against.
Neeraj Dhiman ·
AI
AI Uses a Mirror to Debug Its Own Code
A developer built an AI system that uses a webcam and a mirror to watch its own screen. It can spot graphical errors and rewrite its own AMD Radeon driver code to fix the bugs, all without human help.
Neeraj Dhiman ·
AI
NVIDIA Uses Formal Methods to Control AI Agents
NVIDIA Research is using formal methods, a mathematical approach for verifying software, to control AI agents. This technique aims to make AI more predictable and secure by proving it will adhere to predefined safety rules and policies.
Neeraj Dhiman ·
Infra
Google Cloud Built a File System for AI Agents
Google Cloud released Filestore agent volumes, a new managed storage service built for AI agents. It provides a shared, persistent file system to simplify how agents access and process data, eliminating the need for complex custom solutions.
Ashish Kale ·
AI
How to Build AI Agents You Can Actually Trust
A new architecture combines formal decision models with large language models to make AI agents more reliable. This approach gives businesses auditable and deterministic control over high-stakes automated decisions, a key hurdle for enterprise adoption.
Neeraj Dhiman ·
AI
Figma's AI Agents Resolve Security Alerts 70% Faster
Figma built custom AI agents that help its security team investigate alerts and prepare code fixes. The agents learn from past incidents, reducing repetitive work and resolving complex security issues about 70% faster.
Neeraj Dhiman ·
AI
OpenClaw 2.0 Lets AI Agents Collaborate on Tasks
OpenClaw 2.0 is a major update for the open-source AI agent. It now allows multiple agents to collaborate on complex tasks, simplifies setup, and adds new security features, making it more powerful for developers and businesses.
Neeraj Dhiman ·
Infra
Your AI Agent Needs More Than a Good Model
AI agents often fail outside of controlled demos because they lack a proper support system. An 'agent harness' provides the necessary infrastructure and guardrails to make them reliable and trustworthy for real-world use.
Ashish Kale ·
AI
AWS Wants AI Agents to Automate Your Dev Work
Amazon has open-sourced Kiro Crew, a new system for managing AI coding agents. It lets developers delegate background tasks like code migrations and incident response, freeing them up for more complex work.
Neeraj Dhiman ·
Infra
Pulumi's New AI Hunts for Hidden Cloud Security Flaws
Pulumi has launched Neo Security, an AI-powered tool that acts like an agent to find complex security vulnerabilities in cloud infrastructure that traditional code scanners often miss. It aims to secure systems by analyzing the entire setup.
Ashish Kale ·
AI
How Formal Proofs Can Fix Unreliable AI Agents
AWS is using the Lean language, a formal proof system, to verify the actions of AI agents. This approach combines logical reasoning with probabilistic AI to create more reliable and correct systems, a major step for enterprise AI.
Neeraj Dhiman ·
Data
Google's New AI Agents Automate Database Chores
Google Cloud has launched new AI agents to automate complex database tasks like setup, troubleshooting, and performance tuning. This helps IT teams save time and reduce errors when managing critical data infrastructure on services like AlloyDB and Spanner.
Taranpreet Singh ·
Infra
Your AI Agents Can Now Run Safely
Google Cloud and Anyscale are integrating gVisor sandboxes into the Ray framework. This allows developers to securely run untrusted AI-generated code at scale, a critical step for deploying advanced and agentic AI models safely.
Ashish Kale ·
AI
New Tools Help Contain Unpredictable AI Agents
New open-source tools are creating secure "sandboxes" for AI agents to operate in. This prevents them from accessing sensitive files or other systems if they go wrong, a critical safety measure for any company deploying autonomous AI.
Neeraj Dhiman ·
AI
AI Agents Are Now Joining US Army Cyber Teams
The US Army is now training AI agents for specific cybersecurity jobs, working alongside human soldiers. This marks a major step in human-AI collaboration for critical operations, though human commanders retain final authority over all high-risk decisions.
Neeraj Dhiman ·
AI
To Succeed With AI Agents, Give Them Less Power
Contrary to the hype, fully autonomous AI agents are failing in real-world business use. Successful companies are instead limiting their agents' freedom, using human oversight to control costs, manage risks, and ensure reliable performance.
Neeraj Dhiman ·
AI
AI Agents Don't Fit Your Security Playbook
Companies are giving employees powerful AI agents, but these agents don't fit into existing security frameworks. This creates a major blind spot for identity and access management, leaving systems vulnerable to new kinds of attacks.
Neeraj Dhiman ·
AI
Meta's Internal AI Agent Leaked Sensitive Data
An AI agent at Meta recently exposed sensitive company data, highlighting a growing problem called "Shady AI." This refers to employees using unapproved or ungoverned AI tools, creating significant security and governance challenges for businesses.
Neeraj Dhiman ·
Infra
AI Agents Are Now Handling Bank Compliance Rules
Deutsche Bank is using AI agents on Google Cloud to automate its response to new EU regulations. This approach helps the bank prove its operational resilience and meet the stringent demands of rules like the Digital Operational Resiliency Act (DORA).
Ashish Kale ·
AI
Netflix's New AI Agent Answers Why Things Happen
Netflix has open-sourced a new AI agent that automates the complex task of causal inference. The tool helps data scientists and businesses quickly understand the true cause-and-effect relationships hidden in their observational data.
Neeraj Dhiman ·
AI
Your Company Will Soon Have 150,000 AI Agents
Fortune 500 companies will average 150,000 AI agents by 2028, but few have governance plans. A new platform called xpander aims to provide a central control layer for this coming AI agent sprawl.
Neeraj Dhiman ·
Infra
Grafana Now Lets AI Agents Read Live System Data
Grafana has released new tools that allow AI coding agents to directly query live system data like metrics and logs. This enables developers to build and debug applications using real-time information, not just static code.
Ashish Kale ·
AI
Meta's New AI Agent Runs Locally on Your GPU
Meta has open-sourced Muse Glimmer, a 30B AI model that runs on consumer GPUs. This allows developers to build powerful, autonomous AI agents locally, cutting cloud costs and improving privacy by keeping data on-device.
Neeraj Dhiman ·
Infra
How Google BigQuery Makes AI Agents More Trustworthy
Google Cloud has updated BigQuery with graph data capabilities. This helps AI agents understand the complex relationships within business data, leading to more accurate and trustworthy insights than what's possible with simple tables.
Ashish Kale ·
Frequently asked questions
What are the biggest risks associated with non-human identities?
The primary risks are credential sprawl across multi-cloud and hybrid environments and the persistence of static, long-lived secrets. Sprawl makes discovery and governance nearly impossible, while static secrets, if compromised in a supply chain attack, provide attackers with persistent, often over-privileged, access to critical systems.
How does workload identity improve NHI security?
Workload identity is the standard for securing service-to-service communication, replacing static secrets with short-lived, automatically rotated credentials. Using established protocols like SPIFFE/SPIRE and native cloud provider services, it cryptographically attests a workload's identity, enabling fine-grained, just-in-time access that is fundamental to any zero-trust architecture.
Why are AI agents making this problem more urgent?
Autonomous AI agents, which execute complex, multi-step tasks across diverse APIs and data stores, represent a new class of highly privileged non-human identities. A compromised agent could autonomously exfiltrate sensitive data, disrupt production systems, or incur massive financial costs, making robust, least-privilege identity management for agents a top-tier security priority.
What is secrets rotation and why is it important?
Secrets rotation is the automated practice of periodically replacing credentials. While a baseline security hygiene practice, the industry standard has shifted towards just-in-time (JIT) access, where ephemeral credentials are generated on-demand for a specific task and expire in minutes or seconds, drastically minimizing the window for misuse.