Looking for a recap of our August 2026 “Who’s Minding the Agents? Securing Access When AI Is the User” webinar, or weren’t able to attend? This guide brings together the key research findings, peer poll data, and practical guidance from the session. Covering how AI agents are creating a new and distinct category of access and identity risk, and what organizations can do about it today.
The access problem has changed: when AI is the user
For the past decade, organizations structured their access governance around human users. The question was whether the right person had the right credentials to access the right system. AI agents change the question entirely.
When an agent acts on behalf of a user, four distinct identity risks emerge that traditional controls don’t address:
Risk 1: confused deputy
An AI agent is authorized to perform Task A and, in the process, inherits permissions that also let it perform Task B — even though no one granted Task B explicitly. The agent ends up with more access than anyone intended to give it.
Risk 2: broken attribution
When an agent performs an action — accessing a file, sending a request, writing to a database — the audit log typically records that action under the human user the agent was acting for. If something goes wrong, it is impossible to determine whether the human did it or the agent did.
Risk 3: privilege escalation
Agents often chain multiple tools together across a workflow. At each step, they may request slightly broader access. By the end of a multi-step process, an agent that started with narrow permissions can accumulate access well beyond what any single step required.
Risk 4: no clean revocation
When a human employee leaves, their credentials are revoked. When an AI agent’s task is complete, its credentials often aren’t. API keys, OAuth tokens, and session credentials granted to agents persist in environments that were never built to track or expire them.
| The average enterprise now runs AI agents on behalf of employees who may not know those agents exist — and the credentials those agents are using are no one’s explicit responsibility. |
The numbers behind the problem
These findings come from research conducted ahead of the session, drawing on data from IT decision-makers, security leaders, and executives across industries and organization sizes.
- 92% of organizations have adopted AI in some form
- 73% have no formal governance policy covering AI tool usage
- 61% of IT leaders lack visibility into which AI tools access their systems
- 42% of recent breaches involved compromised non-human credentials
- 8 in 10 security leaders say AI agents represent a new and distinct access risk
- 400+ new AI tools released per month, most without enterprise data protections
| AI adoption has outpaced governance in virtually every organization. The tools are deployed; the policies and controls to govern them have not caught up. |
What your peers told us: live poll results
These results come from live polls conducted during the webinar with attendees representing IT leaders, security managers, and executives across organization types and sizes.
Which AI access challenge concerns your organization most?
| Response | Count | % |
|---|---|---|
| AI adoption is underway, but we lack visibility into how it’s being used | 62 | 37% |
| No enforced AI usage policy exists in our organization | 51 | 31% |
| AI tools requesting access to sensitive systems is our top concern | 35 | 21% |
| We have little or no technical controls over AI access | 18 | 11% |
| More than two-thirds of respondents cited either a lack of visibility or a lack of enforced policy — the two most fundamental prerequisites for any governance program. |
Where is your organization in its AI governance journey?
| Response | Count | % |
|---|---|---|
| We haven’t started a formal AI governance program | 66 | 40% |
| We have some controls in place but no visibility into agent activity | 49 | 30% |
| We have a written policy but no consistent enforcement | 41 | 25% |
| We have a governance program in place for AI agent access | 8 | 5% |
| Only 1 in 20 attendees reported having a governance program in place for AI agent access. Ninety-five percent are still building toward it. |
A five-step framework for AI agent governance
The session’s practical framework gives security and IT teams a structured path from no governance to a defensible program. Regardless of where they’re starting from today.
1. Identify: Discover every AI tool in use across your environment: browser-based, desktop, IDE-integrated, and API-driven. This includes AI features quietly enabled inside existing SaaS platforms you already pay for. You cannot govern what you cannot see.
2. Categorize: Not all AI tools carry the same risk. Distinguish between enterprise-licensed tools with explicit data protection agreements and consumer or free-tier tools where your data may be used for model training. Categorize by account type, not just by tool name.
3. Govern: Define what access AI agents are permitted to have: which systems, which credentials, and under what conditions. Build policies that govern both human users and the agents acting on their behalf. A policy written only for humans will not cover what agents actually do.
4. Monitor: Put ongoing visibility in place for what agents are doing after you’ve granted access. Watch for credential reuse, privilege escalation patterns, and any agent action that exceeds what the original task required.
5. Protect: Enforce the policies you’ve defined. LastPass SaaS Monitoring (available in Business Max) gives IT visibility into which AI tools employees access through the browser, which accounts they use, and whether credentials are vault-managed or personal. SaaS Protect layers on access controls — warn, block, or redirect based on tool and account type.
Questions your peers asked
These are the questions submitted and answered by our speakers at LastPass. Jason Rasmussen CTO, Matt Greany Director of Product Management, and Emily Calo Manager of Product Marketing.
Does LastPass have an enterprise solution to manage multiple employees leveraging AI agents on their behalf, and to understand how credentials are being used?
LastPass Business Max includes SaaS Monitoring, which gives admins visibility into which AI tools and AI assistants employees are using, and flags the credentials tied to those tools that are weak, reused, or breached. Every login — human or agent-initiated — routed through LastPass is subject to the same password policies, shared-folder controls, and breach alerting as any other app. The key here is that the interactions and agents need to be browser-based for our visibility and enforcement to apply. That’s where all of our context resides currently. What we don't yet offer is secure credential access for agents, or a dedicated non-human identity management (i.e., governing an agent's own API keys/tokens independent of a human login) — that's the gap Jason described as one of the chief problems facing businesses in the webinar. This is something we’re actively working on with the new CLI and MCP. We’re also exploring solutions for agents running in context outside of the browser on a device.
What specific tools are you using to discover shadow AI & Shadow Applications to create visibility into what's actually being used?
Discovery comes through the LastPass browser extension: as employees log into apps, SaaS Monitoring identifies AI tools and other SaaS apps in use, including ones IT never approved, and surfaces them in the Admin Console for categorization (approved / warn/ blocked).
Is it generally safer to use native AI tool in a small practice, or would a third-party AI tool be better? Specific to use with LastPass. A Third Party (API) posing external risk, Native posing internal risk.
Without having a lot more background context, I would say it’s generally safer to run 3rd party AI vendor solutions than a homegrown LLM-based solution. That’s the stock answer if the use case primarily centers around unknown or unspecified uses. An LLM isn’t a one-size-fits-all solution, and there can be many instances where an organization would be better served by creating and training their own models. However, good practice currently is to create intentional models with a very well-defined purpose and scope. Something so explicitly defined is likely to be used for proprietary purposes like enabling a product rather than for internal ops efficiencies. Simply taking an off the shelf model and training it with internal data could work just fine in theory, but none of the more advanced guardrails provided by the larger, more established commercial vendors will be in place. You’d effectively have to craft all of that bespoke to whatever is being used internally. The potential risks could certainly outweigh the initial rewards.
Does LastPass have a feature to place the credentials in the execution environment, rather than the prompt? Basically, a keyring type setup. There is open vault, which does something similar, would be great to see a LastPass Enterprise solution.
This fits within core Secrets Management capabilities and currently runs outside of the LastPass product scope. Prior to the proliferation of AI agents acting on behalf of humans, our strategic position has been that other vendor solutions like HashiCorp Vault and AWS Secrets Manager are already deeply penetrated into this market. We historically serve human principals in their daily tasks while a secrets manager fits within the realm of DevOps and service principals. AI agents acting at the behest of humans smudges the lines between these two worlds, and we are actively evaluating where and how we can best provide value in this emerging space. Offering a CLI/MCP to provide agents secure access to agents is already in development, but there are certainly additional areas for us to potentially expand our offering as well.
With the Claude Chrome extension combined with LastPass extension, Claude can access all applications in the LastPass user has access to. How do I secure LastPass to stop Claude using auto-filled credentials when driving the browser?
Today there's no LastPass control that distinguishes a human-driven autofill from an agent-driven one. LastPass autofill responds to a page request regardless of whether Claude or a person triggered it. Interim mitigation: restrict autofill via URL/domain restrictions, disable auto-fill-on-page-load in policy, and require master password re-prompt on autofill for sensitive items. That reduces exposure but doesn't fully solve it. The use case is straightforward, and this is something we will evaluate from the Product side.
We've looked at companies that do this sort of thing for you, like Datadog, but haven't moved forward yet. Does LastPass have a product that does the same thing (mainly sections 4 and 5 of the governance plan)?
Yes — this five-stage framework maps directly to capabilities LastPass ships today, primarily through SaaS Monitoring and Business Max:
- Identify / Categorize: SaaS Monitoring discovers AI tools and apps via the browser extension and lets admins flag approved vs. shadow, shared vs. individual credentials, and weak passwords tied to those apps.
- Govern: Admin Console policies route app logins through LastPass, enforce password policies, and control shared vault/folder access — the same controls used for any other app, applied to AI tools.
- Monitor: Breach alerts fire when a vendor is compromised; credential health is visible in the Security Dashboard.
- Protect: Policy controls let admins allow, restrict, or block specific apps, including unsanctioned SaaS and generative AI tools.
One caveat worth stating plainly: this is the app-level governance loop — credentials tied to an AI tool a human logs into. It does not cover agent-native credentials (API keys, tokens, OAuth grants an agent holds and uses without a human login), but as mentioned this is something we are actively working against on a few different fronts.
Is this currently available on LastPass?
Every pillar, one through five, is available for LastPass Business Max customers. The Governance aspects are also dictated by the organization, and LastPass provides controls to enact and monitor the guidance.
Matt brought up that LastPass is working on a way to direct the agents to LastPass. Is that something that has a timeframe for release?
This is correct. We have started working on both a revamped CLI as well as an MCP that will allow agents to securely access Vault and Shared items on a user’s behalf. We have some functional dependencies to clear presently, and I expect to have a clearer picture on when this functionality will become generally available as we get closer to end of year.
How does it identify the various AI platforms that are being used? Does it use DNS filtering to find them?
All of our visibility comes directly from the browsers where the LastPass extension is deployed and managed. This provides a wealth of information in terms of SaaS applications accessed, who’s accessing them, and how they are authenticating. We also use the same lightweight extension to apply governance controls and policies set by the organization’s admin.
At present my company has a small pool of people that use LastPass for credentials, far exceeding the number of people using AI tools. Would LastPass licensing need to be purchased for everyone to make use of the level of LastPass that has the monitoring?
SaaS Monitoring's visibility depends on being licensed for Business Max and extension deployment. You need LastPass deployed to the users whose activity you want visibility into. If most AI-tool users aren't LastPass users today, the practical answer is you'd need to extend LastPass licensing to that population to monitor it. It’s also worth noting you instantly have visibility & governance into all SaaS applications and sites – not just AI usage.
We already pay for the enterprise licensing; is it already part of what I pay for or how much additional does it cost?
SaaS Monitoring & Protect are available in Business Max only. I would suggest reaching out to your account executive to ensure you’re at the correct product tier to use this capability.
What are some safeguards in place in protecting LastPass vaults to avoid other AI agents from breaching users’ accounts?
Standard vault protections apply regardless of whether the threat actor is human or an agent: zero-knowledge encryption, MFA enforcement, device restriction policies, and breach/dark-web monitoring alerts. Worth being clear, this is the same protection model as any credential-stuffing or account-takeover attempt — LastPass doesn't currently have an AI-specific detection layer distinguishing agent-driven attack patterns from human ones.
For individuals and companies that want additional protection, LastPass users can make use of existing security settings such as:
See what’s running in your environment
Automatically discover AI tools and SaaS applications across your organization with LastPass Business Max. Talk to our team to start a free trial.
