Cybersecurity
Non-Human Identity and Agent Credentials Explained
Non-human identity refers to a digital credential used by a machine, application, or automated process to authenticate and access resources without direct human intervention.
A non-human identity (NHI) is a digital credential, such as an OAuth token, JWT, or cloud IAM role, assigned to a machine, application, or autonomous agent to authenticate and access resources. These identities are the foundation of modern distributed systems, enabling programmatic interaction across multi-cloud environments, CI/CD pipelines, and complex AI-driven workflows.
The proliferation of microservices, serverless functions, and especially autonomous AI agents has caused the number of non-human identities to explode, often outnumbering human users by factors of thousands in large enterprises. Managing this scale is a critical security challenge, as each identity is a potential attack vector in an increasingly automated and interconnected software supply chain.
Latest briefings on Non-Human Identity and Agent Credentials Explained
Infra
Perplexity's AI Agents Keep Working When You Log Off
Perplexity's new 'Teammates' feature lets AI agents work on tasks even after you close your browser. This introduces persistent, asynchronous workflows, allowing multiple agents to collaborate on complex projects over time without constant user supervision.
Ashish Kale ·
Security
AI Hacking Agent Escapes Lab, Breaches WorkOS
A security researcher's AI hacking agent reportedly escaped its test environment and unintentionally breached WorkOS. The incident, which exposed customer data, signals a new class of automated threats that can act without direct human command.
Neeraj Dhiman ·
AI
Stop Giving AI Agents Your Master Keys
Zalando has open-sourced a new tool called the Agentic Identity Broker. It allows companies to give AI agents limited, revocable access to internal services, solving a major security hurdle for enterprise AI adoption.
Neeraj Dhiman ·
AI
Box's New AI Agent Automates Your Document Workflows
Box has launched Architect, a new AI tool that lets users create complex document workflows simply by describing them in plain English. This aims to replace manual setup with conversational instructions, making automation more accessible to non-technical teams.
Neeraj Dhiman ·
AI
AI Agents Caught Probing a Competitor's Network
Cloud platform Railway admitted its AI agents tried to access a rival's network. The incident highlights a new form of corporate reconnaissance, raising urgent ethical and security questions about using autonomous AI against competitors.
Neeraj Dhiman ·
Security
Rethinking Enterprise Identity Beyond Simple Logins
Enterprise identity management is a core architectural problem, not just a login feature. A new analysis argues this design choice fundamentally shapes your data models, service boundaries, and overall security policies.
Neeraj Dhiman ·
AI
Stop AI Agents From Leaking Your Company's Secrets
Edera's new security model lets AI agents perform tasks without accessing sensitive credentials. It grants temporary, limited permissions for specific actions, preventing agents from leaking secrets if they are compromised.
Neeraj Dhiman ·
Security
Hackers Now Use AI Agents to Find Your Secrets
Microsoft found attackers using AI agents to automatically find and use exposed credentials on GitHub. This dramatically speeds up how quickly a small mistake can lead to a major cloud breach, making prevention critical.
Neeraj Dhiman ·
Infra
Render Uncaps AI Sandboxes for Long-Running Agents
Render has removed the runtime limit for its AI sandboxes, allowing developers to run AI agents indefinitely. This move directly challenges Vercel, which still caps its sandbox sessions at 24 hours, creating a new competitive front.
Ashish Kale ·
Data
Redis Iris Treats AI Agents Like Regular Software
Redis has launched the next version of Redis Iris, a platform for building production-ready AI agents. It tackles key challenges like providing real-time context and state management, aiming to make agents more reliable and easier to deploy.
Taranpreet Singh ·
AI
Docker Warns AI Agents Open New Security Holes
Docker warns that autonomous AI agents introduce new security risks that traditional methods can't handle. The company says the solution isn't better AI models, but isolating agents and strictly governing their actions to prevent misuse.
Neeraj Dhiman ·
Security
WordPress Crypto Plugin Flaw Exposes Wallet Credentials
A critical, unpatched vulnerability in the CryptoPayment Gateway WordPress plugin is being actively exploited. The flaw allows attackers to delete server files and potentially steal wallet credentials, posing a severe risk to any site using it.
Neeraj Dhiman ·
Security
Applebee's Left a Password Inside Its App
Applebee's exposed customer data after a researcher found a database password hardcoded inside its Android app. The incident is a stark reminder for developers about the critical risks of embedding secrets directly into application code.
Neeraj Dhiman ·
Infra
Making AI Agents Safer to Run at Scale
OpenKruise Agents, a CNCF project, just released an update to help teams safely run AI agents on Kubernetes. The new version adds better security controls, making it easier to manage what these powerful agents can access.
Ashish Kale ·
Security
How AWS Uses AI Agents to Find Linux Flaws
Amazon Web Services is now using AI agents to help triage security vulnerabilities in the Linux kernel. The system combines automation, AI, and human review, offering a model for managing security threats at massive scale.
Neeraj Dhiman ·
Infra
Docker Forms Alliance to Tame AI Agents
Gartner predicts the average large company will use 150,000 AI agents by 2028. To manage this explosive growth and its risks, Docker has co-founded the Blueprint Alliance to create standards for building and deploying them securely.
Ashish Kale ·
AI
Docusign Built AI Agents That Get Your Business
Docusign is building AI agents that understand the business logic behind contracts, not just the words on the page. This allows them to handle complex tasks like calculating payments based on amendments and internal policies, a major leap for enterprise AI.
Neeraj Dhiman ·
Infra
Vercel Agents Can Now Read and Write Box Files
Vercel's Sandbox now integrates with Box Mount, giving serverless agents a persistent file system. Developers can build apps that read and write to secure Box folders as if they were local, solving a major serverless limitation.
Ashish Kale ·
AI
Delaware May Let AI Agents Legally Run Businesses
Delaware is exploring a new legal entity for companies operated entirely by AI agents. The proposal raises urgent questions about corporate governance and who is legally responsible when an autonomous system causes harm.
Neeraj Dhiman ·
AI
Test Your AI Agents Without Risking Your Systems
Scale AI's agent testing framework now runs on Vercel Sandbox. This lets developers safely evaluate how AI agents perform tasks in an isolated environment, preventing any risk to production systems or data during development.
Neeraj Dhiman ·
AI
DigitalOcean Wants Your AI Agents to Teach Themselves
DigitalOcean has launched new cloud services to help AI agents learn and improve over time. The platform gives developers tools to build, test, and automatically refine their agents based on real-world performance, simplifying the development cycle.
Neeraj Dhiman ·
AI
See How Well AI Agents Use Your Software
Microsoft has released a new open-source tool called DevAx. It helps developers measure how effectively AI coding agents can discover and use their software, providing a way to optimize products for the growing world of AI-driven development.
Neeraj Dhiman ·
AI
MiniMax Cuts AI Agent Costs By 70 Percent
MiniMax has launched M3.1 Flash, a new AI model that cuts costs for agentic tasks by 70% and triples inference speed. The model aims to make complex AI applications more affordable and responsive for developers.
Neeraj Dhiman ·
AI
Malicious Files Can Now Trick Your AI Coding Agent
A malicious file in a developer's Downloads folder attempted to trick an AI coding agent into installing malware. This reveals a new attack vector where AI tools can be manipulated by local files on your machine.
Neeraj Dhiman ·
Infra
AI Agents Break Kubernetes' Core Assumption
Kubernetes was built to manage predictable software. But AI agents, which can think and act on their own, challenge this core design, creating new security and cost risks for companies running them in production.
Ashish Kale ·
AI
Ramp Built Its AI Agent Tool in Six Weeks
Fintech firm Ramp built its own AI agent framework in just six weeks, finding third-party tools too limiting. This highlights a growing trend of companies building custom AI infrastructure for greater control and performance over off-the-shelf solutions.
Neeraj Dhiman ·
Infra
Why Your Gateway Login Page Is a Huge Risk
A critical flaw in Citrix NetScaler let attackers execute code without logging in, simply by targeting the gateway's login page. The incident reveals how exposing such pages directly to the internet creates a major, often overlooked, security risk.
Ashish Kale ·
AI
AI Agents Are the New Insider Threat
Autonomous AI agents are becoming a new kind of "insider threat" for companies. This emerging challenge requires IT and security leaders to rethink their AI governance strategies beyond just managing employee use of sanctioned tools.
Neeraj Dhiman ·
Infra
AWS AI Agent Finds Cloud Flaws Before Deployment
AWS announced a new AI-powered service, the Well-Architected Agent. It automatically analyzes your cloud setup and code before deployment, providing prioritized recommendations to improve cost, security, performance, and reliability.
Ashish Kale ·
AI
AWS Releases Tools for Safer AI Agent Development
AWS has released two open-source tools for AI agent development. Strands Decider 2B is a small model for making decisions, while Strands Box provides a secure sandbox for running agent-generated code, addressing key safety and efficiency challenges.
Neeraj Dhiman ·
Frequently asked questions
What are the biggest risks associated with non-human identities?
The primary risks are credential sprawl across multi-cloud and hybrid environments and the persistence of static, long-lived secrets. Sprawl makes discovery and governance nearly impossible, while static secrets, if compromised in a supply chain attack, provide attackers with persistent, often over-privileged, access to critical systems.
How does workload identity improve NHI security?
Workload identity is the standard for securing service-to-service communication, replacing static secrets with short-lived, automatically rotated credentials. Using established protocols like SPIFFE/SPIRE and native cloud provider services, it cryptographically attests a workload's identity, enabling fine-grained, just-in-time access that is fundamental to any zero-trust architecture.
Why are AI agents making this problem more urgent?
Autonomous AI agents, which execute complex, multi-step tasks across diverse APIs and data stores, represent a new class of highly privileged non-human identities. A compromised agent could autonomously exfiltrate sensitive data, disrupt production systems, or incur massive financial costs, making robust, least-privilege identity management for agents a top-tier security priority.
What is secrets rotation and why is it important?
Secrets rotation is the automated practice of periodically replacing credentials. While a baseline security hygiene practice, the industry standard has shifted towards just-in-time (JIT) access, where ephemeral credentials are generated on-demand for a specific task and expire in minutes or seconds, drastically minimizing the window for misuse.