Perspectives

Is this identity still human? AI agents running under human credentials

Sep 21, 2026 • 5 min read

A credential issued to a person does not establish that a person is using that credential. The same access can be driven by the employee, by a script the employee wrote, or by an AI agent the employee connected to production. ClearVector observed AI agents in production at multiple customers in the fourth quarter of 2025. Authentication records which credential was presented, not who or what sat on the other end of the session.

‍

What percentage of production identities are non-human?

The ClearVector Identity Intelligence Report (CVIIR) 2026 found that 91% of identities in production are non-human.

‍

Figure 1 shows the identity composition of the production environments analyzed for the report: 91% of identities operating there are non-human, as compared to 9% being operated as human.
‍

Horizontal bar chart of production identity composition from the ClearVector Identity Intelligence Report 2026: 91 percent non-human identities and 9 percent human identities, across the AWS and Google Cloud environments analyzed — Figure 1. Identity composition in production. Non-human identities include service accounts, assumed roles, continuous integration tokens, vendor integrations and AI agents. Source: ClearVector Identity Intelligence Report 2026.

‍

The harder case is the credential issued to a human. An AI agent that leverages a developer’s production access authenticates as that developer, holds that developer’s privileges, and can run around the clock - with a portion of the activity moving at machine speed. The identity provider records a legitimate human authentication. The security information and event management system (SIEM) records a legitimate session. Neither record separates how the developer works from how an AI agent operating under the same credentials.

‍

Human identities use directly or indirectly non-human identities

When the adversary steals a package maintainer’s credentials and publishes a backdoored version of a widely installed package, this appears to be business as usual - there's a new version of the package now available.

‍

Next, any developers that use this package update to the latest version - there are no security advisories at this time - a reviewer approves the pull request. CI/CD builds and deploys software - days later the maintainer discloses the theft and the package registry removes the malicious version. However, by then the payload has potentially run in many different environments. Now the question becomes what happened.

‍

Figure 2 traces that path from the developer laptop into production, and highlights different critical steps in the process.

Diagram tracing a compromised open source package from a developer laptop through the source repository and build pipeline into a production environment, where a stolen credential assumes a role that reaches both an AI agent runtime and a managed model service, and the agent then reaches a model API outside the environment, with a question mark marking where the record of what the credential did runs out — Figure 2. How a package compromise becomes an identity problem. Steps 1 through 4 are routine engineering processes. From step 5 onward, the activity runs under a credential the environment already trusts, and every action appears authorized.

‍

After a package compromise, a company has to discover which credentials the adversary used, what those credentials did before disclosure, and what systems, services, or data those credentials never touched. Without identity attribution, the team rotates every credential that might have been present and cannot say whether the adversary used any of those credentials. A record of activity mapped to each credential answers all three questions, and a credential with no runtime activity in that window is defensible evidence that the backdoor never ran in production. Rotation and customer notification then narrow to the credentials and systems actually affected.

‍

Figure 3 shows the questions you need to answer on the Friday evening the disclosure lands.

Six questions a security leader faces when a backdoored package may have reached production: whether to notify customers, notify the SEC, call the insurance provider, contact investor relations, contact the developer, and whether the compromise is an inside job, all resting on one underlying fact about what the stolen credentials did in production. — *Figure 3. Six questions, one underlying fact. Each question resolves to what the stolen credentials did in production and what systems, services, or data those credentials never touched.*

‍

Why an AI tool inventory does not surface agent activity in production

The common answer to AI risk in production is a list: name the approved AI tools, govern the list, review the list quarterly. A list answers a procurement question. Activity under a human-issued credential is not a procurement event, because nothing new is requested and nothing new is provisioned. The AI agent operates on access a person already holds and a reviewer already approved.

‍

“We should not just be able to show you the runtime activity. We should be able to say: you have an agent in production, and it is this vendor called Letta. Did you know that? Did you know your developer shipped that thing?”
John Laliberte, CEO, ClearVector

‍

Identity breaches where the adversary is AI enabled, steals credentials, and then reaches parts of an environment the operator could not have reached alone are on the rise. The change ClearVector observes is scope rather than speed: an operator who knows Windows and macOS, working with a model, now moves into production environments because the knowledge for this now sits in the model. Google Cloud’s Office of the CISO reported in the Cloud Threat Horizons Report, H1 2026 Board Edition found that 83% of intrusions involve stolen credentials, which is the same argument arriving from outside ClearVector’s dataset.

‍

The package compromise and the AI agent are the same problem. Public threat intelligence has documented adversary use of AI tools for reconnaissance, credential harvesting, and network penetration (Anthropic Threat Intelligence, August 2025). Unmanaged AI, meaning AI tooling operating under credentials issued for something else, is a post-exploitation payload rather than a separate category of risk. The adversary reaches the environment through a stolen credential or a poisoned dependency, and the tooling that follows runs with the access that credential already holds.

‍

How to tell what an identity actually did under a valid credential

Checking whether the credential is valid resolves nothing, because the credential is valid in every case above. The question that separates an ordinary Tuesday from an incident is what ran using that credential and whether that activity is risky. Answering that question requires a pattern of life for every identity in production, humans, NHIs, and third parties, and a known-good operating model of how each identity operates. Predictive Behavioral Defense is the method: a live operating model of how every identity operates, built inside each customer’s own environment, so an adversary cannot test against a model the adversary cannot access.

‍

Many teams ClearVector spoke with in September 2026 asked for one capability ahead of every other: isolation of the identity, and specifically whether isolation happens on defined conditions rather than waiting for a person to approve the action. That request is the operational version of the same question. A team that cannot name what an identity did cannot decide whether to cut that identity off.

‍

John Laliberte on identity activity in production at SecureWorld

John Laliberte presents “Is This Identity Still Human? Identity Activity in Production Environments” at SecureWorld Atlanta on September 24, 2026, at The Westin Atlanta Perimeter North, and again in the SecureWorld webinar on September 29, 2026. The Atlanta session covers proof in identity and supply chain attacks. The webinar walks through the package compromise scenario in detail: what a stolen maintainer credential reaches, and what a team can prove afterward. Registration for the webinar is open and carries one CPE credit.

‍

Registration for the webinar is open at https://www.secureworld.io/resources/is-this-identity-still-human and carries one CPE credit.

‍

Related questions

What do you have to answer when a backdoored package may have reached production?

Six questions arrive at once, and every one needs the same underlying fact. Do I notify customers. Do I notify the SEC. Do I call the insurance provider. Do I contact investor relations. Do I contact the developer. Is this an inside job. Answering any of them requires knowing what the stolen credentials did in production, which is why the record of activity per identity has to exist before the disclosure rather than after.

How do you tell whether an AI agent is using a developer’s production credentials?

Not from the authentication record, which shows a valid human session. The separation comes from the activity under that credential: what the identity touched, in what order, at what hour, and at what rate, compared against the pattern of life that identity has established in production. ClearVector observed AI agents in production at multiple customers in the fourth quarter of 2025.

How do you prove a backdoored package never ran in production?

By showing what each credential on the affected systems did in production during the window between installation and disclosure. A credential with no runtime activity in that window is evidence the payload never executed with that credential. Producing that evidence requires activity mapped to each identity before the compromise is disclosed, because the record cannot be reconstructed afterward.

Do identity providers show AI agent activity in production?

Identity providers establish which credential authenticated and what that credential is permitted to reach. Identity providers do not record what the identity did after authentication inside the production environment, which is where an AI agent under a human credential operates.

What is the blast radius when an AI agent runs under a human-issued credential?

The blast radius is the full scope of that human’s production access, including every role that human can assume, because the AI agent inherits the access rather than requesting new access. Reconstructing that scope after an incident requires the full role chain, not the authentication event.