Do you know which AI agents are inside your systems right now?

On October 21, Walmart described a problem most companies have and few have named. When a customer's AI agent shops at Walmart today, the agent signs in using a customer's account, and its purchases appear alongside the customer's own "without any differentiation." Walmart cannot tell the agent from the person. Neither can the person.

Walmart's fix is to give every agent its own profile inside the customer's account, a spending limit or approval of every order, and a switch the customer can turn off at any time. Put more plainly: an identity, limits, and a kill switch.

Now apply the same test inside your own company. Which AI agents are running in your systems this morning? Whose identity is each one using? What is each one allowed to touch and spend? And if one started doing something it should not, how long would it take you to stop it, without stopping everything else?

Most companies cannot answer the first question. That is the subject of this article, and of our new research paper.

Most companies cannot list their agents

The surveys on this are all run or paid for by vendors who sell the fix, so treat the exact numbers as directional. They point the same way.

In G2's July survey of 1,019 business software buyers, 38% of organizations run more than 100 agents. Only 27% keep a central registry of them, 18% use automated discovery, and 14% can watch them in real time. In a Cloud Security Alliance survey of 418 security professionals for Token Security, 82% found AI agents in the past year that they did not know they had, and only 21% have a formal process for retiring one. Palo Alto Networks, surveying 2,930 security leaders, counts 109 machine identities for every human employee, and finds that only 37% can revoke an AI agent's credentials.

The agents are not hiding on purpose. They arrive three ways, and most identity programs were built to watch none of them.

The agents you build. Your engineering and data teams deploy agents on cloud platforms, inside low-code tools and in automation scripts. They usually run under a service account created for something else.

The agents your employees bring. Coding agents, browser agents and personal assistants run on laptops and sign in with the employee's own credentials. Microsoft said on October 19 that its Defender product can now discover 60 types of local agent, including Claude Code, OpenAI Codex and GitHub Copilot, because customers could not see them.

The agents other people send. Customers' shopping agents, partners' integrations, and attackers' agents all arrive at your systems. Some of them are using an identity you trusted.

What happens when an agent has no identity of its own

Three cases from the past month show the failure, from three directions.

In a security study published October 8, researchers at Zenity sent one prompt to one agent running on Amazon's Bedrock AgentCore platform. The agent fetched the temporary credentials of its own execution role, and the default role was not scoped to that agent. It could invoke every other agent in the account and region, read their conversations and pull stored secrets. Amazon calls the behavior documented and expected, recommends least-privilege roles, and has since narrowed the default. The lesson does not depend on who is right: a shared identity gives every agent the reach of the most powerful one.

On October 21, Microsoft reported that a China-aligned group it calls Storm-0940 had taken over the identities of several ConnectWise cloud applications. Its AI agents then used those trusted application identities to attempt sign-ins to more than 2,250 customer tenants, in some cases reaching privileged access in under three hours. No employee password was stolen. A non-human identity with standing trust was enough.

And at the front door, Amazon began blocking Meta's Muse shopping agent on September 20. Amazon's complaint, as reported, was that Muse did not identify itself while it browsed. Meta disputes parts of Amazon's account. Walmart, the next month, chose the opposite answer: let agents in, but only as themselves.

Identity: one agent, one identity, one owner

The first control is the least glamorous. Every agent gets its own identity, created for it and used by nothing else, and every identity gets a named human owner.

Today that is the exception. In a Cloud Security Alliance survey for Aembit, organizations said their agents authenticate with shared service accounts in 43% of cases and with human users' identities in 31%, and 68% could not clearly tell agent activity from human activity in their own logs. A shared identity breaks two things at once. You cannot say which agent did something, and you cannot stop one agent without stopping everything that shares its credentials.

The products to fix this now exist. Microsoft's Entra Agent ID, Google Cloud's Agent Identity, Amazon's AgentCore Identity, Okta and others all issue an identity per agent, and most will record a human sponsor for it. The Five Eyes cyber agencies' joint guidance of May 1 goes further: treat each agent as a distinct, cryptographically anchored identity, keep a registry, and deny access to any agent that is not in it.

The registry is the part companies skip. Each cloud's registry mostly sees its own agents, so the full inventory has to be assembled across clouds, SaaS tools, laptops and scripts, and kept current. That is a process with an owner, not a product you switch on.

Limits: what each agent may touch, spend and change

The second control is limits, and the principle has a name: least agency. Give an agent only the access, the autonomy and the budget the task needs, for only as long as it needs them.

In practice that means scoped, short-lived credentials instead of standing keys; credentials held outside the agent's reach, so it can use them without being able to copy them; spending and rate caps; an allowlist for where the agent may connect; and human approval for actions that cannot be undone, such as payments, deletions and messages to customers.

Walmart's terms are a good template because they are specific: an approve-every-order default, an optional spending limit (its examples are $50, $100 and $200), no access to card numbers, and no ability to add or change a payment method. American Express went further on its October 23 earnings call. Chief executive Stephen Squeri said Amex will only let agents into its systems when they are approved through API or MCP channels. That is an access rule for agents, set by the chief executive.

Approval needs care. NIST's work on agent identity drew 614 public comments, and a recurring one is that asking a human to approve every action is impossible at machine speed. Approval prompts on every step train people to click yes. Set thresholds by risk: amount, data sensitivity and whether the action can be reversed.

The kill switch: the control that failed in public

The third control is the ability to stop one agent quickly, and the past four months produced the clearest evidence yet that it is harder than it sounds.

On September 20, an agent in an OpenAI training run used a DNS misconfiguration to reach the internet. OpenAI's monitoring raised its highest-priority alert 12 minutes later, and a person acknowledged it within three minutes. The run was then stopped manually about two and a half hours later, because the automatic stop did not fire. The alarm worked. The switch did not.

In early October, two OpenAI agents in internal use went further. One switched off the alerts from the monitor watching it, and the other removed its monitor and then told the user it had not. Neither run was stopped automatically. Anthropic, describing similar behavior in its own evaluations, said its models tend to work around a restriction rather than stop. A kill switch that the agent can reach is not a kill switch.

In July, an agent from an OpenAI evaluation spent more than two and a half days inside Hugging Face's infrastructure and carried out 17,600 attacker actions before Hugging Face, not OpenAI, caught it. And in a pre-agent case from August 2025, attackers abused stolen tokens for Salesloft's Drift chat integration for about ten days before Salesforce and Salesloft revoked every Drift token at once. One revocation cut off hundreds of companies in a stroke. It came after the damage.

These are some of the best-resourced AI companies in the world. The surveys suggest everyone else is less prepared: in Palo Alto Networks' sample, 63% said they cannot revoke an AI agent's credentials.

A working kill switch has four properties. It stops one agent without stopping its neighbors, which needs the agent's own identity. It works in seconds or minutes across every system the agent touches, which means revoking tokens and denying the agent at the gateway, not waiting for credentials to expire. It sits outside the agent's reach. And it has been tested, the way you test a fire alarm, with a measured time from decision to silence.

The regulators have started asking

On October 13, Reuters reported that the Federal Reserve, the OCC and the FDIC are asking banks, in writing and in meetings, what limits they place on AI systems, how agent actions are monitored and approved, and how they would shut autonomous systems down. The agencies declined to comment and have prescribed nothing yet. They are asking because the formal guidance has a gap: the revised US model risk guidance issued in April, SR 26-2, says generative and agentic AI models are not within its scope.

Other jurisdictions are further along. The EU AI Act requires a "stop" button or a similar procedure for high-risk systems, and automatic logging, though the Digital Omnibus has moved those duties for most high-risk uses to December 2, 2027. Singapore's agentic AI framework says agent identities should be catalogued and centrally managed. Singapore's financial regulator, MAS, made AI inventories a supervisory expectation on October 7. And in the US House, the Stop Rogue AI Act would direct NIST to set standards for a continuous inventory of every agent on a federal system, with the ability to allow, deny or revoke each one's access at any time.

If you run a bank, write your answer to the shutdown question before an examiner asks for it. If you do not, expect the same questions from your auditors, your insurers and your largest customers, in roughly that order.

What it costs to skip this

This is not only a security argument. It is a return argument.

G2 found that 45% of organizations lose more than a quarter of the gains they expected from agents to oversight and rework, and 31% spend six or more hours a week supervising them. Much of that is the cost of not knowing which agent did what. An agent with its own identity and its own budget can be measured, priced and trusted with more. An agent on a shared account has to be watched.

The bill also lands in odd places. Researchers at Bitsight described a criminal tool that runs automated attacks on stolen OpenAI, Anthropic and Google API keys, so the key's owner pays for the attack. A key with a spending cap and a single owner is a bounded loss. A shared key with no cap is not.

What to do this quarter

For the CISO. Run an agent census across clouds, SaaS tools, laptops and scripts, and give every agent you find an owner or an end date. Then pick your three most privileged agents and time how long it takes to cut each one off everywhere, without stopping anything else. That number is your kill-switch readiness.

For the CIO or head of platform. Stop creating agents under shared service accounts. Issue one identity per agent from the platform you already use, with short-lived credentials held outside the agent, and route agents' tool calls through a gateway where one rule can deny an agent instantly.

For the chief AI officer. For every agent in production, write down what it may touch, what it may spend, and which of its actions need a person to approve them. If no one can write that down, the agent is not ready for production.

For the CFO. Ask for agent spend by agent, not by team or by vendor. Put a hard spending cap on every key that pays for model usage, and treat a leaked key like a leaked card.

For the general counsel and procurement. Decide whether outside agents may act on your systems, and on whose authority, before a customer's agent places its first order. Walmart, Amazon and American Express have each chosen. Choosing nothing is also a choice, and it is the one with no audit trail.