Why Token Handling Must Evolve for AI Agents
J Simpson · rss · 2026-04-20 source ↗ Reader 🖥️
Static, session-based access-token models designed for human users are fundamentally unsuited to autonomous AI agents, and must be replaced by runtime, context-aware, short-lived, minimally-scoped token strategies to prevent the class of credential-abuse breaches that already accounts for a fifth of all data breaches.
practical · argumentative — The article argues that traditional token-handling practices are inadequate for agentic AI and prescribes four concrete design shifts (runtime evaluation, context-dependence, short-lived tokens, least privilege). It is practical because the propositions serve 'you should change X' recommendations aimed at API architects and security engineers.
Structure
| Part | Role |
|---|---|
| Opening: the UNC6395 / Salesloft breach and credential-abuse statistics | Motivating evidence — establishes the real-world cost of inadequate token handling |
| Bridge: AI systems are outside traditional cybersecurity governance | Problem framing — connects the general credential problem to the specific AI-agent domain |
| Four requirements for evolved token handling (runtime, context, short-lived, least privilege) | Core prescription — the four design principles the article advocates |
| Travel-agent scenario | Illustration — makes the abstract principles concrete through a worked example |
| Closing: emerging standards (MCP, Arazzo, A2A, ANP) and token-intelligence systems | Solution landscape — positions the four principles within the broader ecosystem of emerging protocols |
Key terms
- token intelligence Agent Governance (Internal)
A system capability that evaluates an agent's identity, delegation chain, and reasonable scope in real time, producing auditable access decisions - context-aware access control Agent Governance (Internal)
Authorization that considers who is acting, why, on whose behalf, and the current system state — not merely the identity of the caller - agentic AI Agentic AI
Autonomous software agents that make sequences of API calls without direct human supervision per call
Propositions
- empirical21% of data breaches are caused by credential abuse, and 88% of basic web-application attacks involve stolen credentials.
- descriptivecorroboratedTraditional API authentication is designed for humans requesting permission; once granted a token, the holder has broad access for the session's duration.supports ←What Is a Token? A Developer's Guide to Every Type · p3 — This article's description of a bearer token as granting access 'to the party holding the token' matches and grounds the other piece's characterization of traditional token auth: once granted, the holder has broad access for the token's/session's duration -- the very property that piece argues is unsuited to autonomous agents.
- prescriptivedevelopedAuthorization for AI agents must happen at runtime — evaluating each call as it occurs — rather than at session start.extends ←The Meter Was Always Running · p7 — Token-handling argues authorization for AI agents must be evaluated at runtime, per call, rather than at session start; Haelen's identity-and-authority-context signal (principal_id, delegated_scope, service_account, data_scope captured per turn) is the audit trail that would let you verify that runtime, per-call authorization actually happened.
- prescriptiveToken authorization must be context-dependent: knowing not just who is calling but why, on whose behalf, and what the system state is at the moment of the call.
- prescriptiveestablishedTokens for AI agents should be as short-lived as possible, ideally issued per individual request.supports ←The Claude Code active attack didn't stop. 294,842 secrets stolen from 6,943 machines. It evolved and now spreads through Python too and uses Claude Code itself to steal your secrets. The risk to your credentials just got bigger. · p12 — Leaked secrets abused within minutes yet valid for years is the empirical case for short-lived tokens.supports ←How to Manage Privilege Drift in Multi-Agent Systems · p6 — Same JIT / short-lived-token prescription, applied here to inter-agent and service-account credentials specifically rather than user-facing agent tokens generally.extends ←What Happens After Every Company Becomes a Data Company? · p6 — Both argue for short-lived, minimally-scoped, just-in-time tokens over broad session grants; this article generalizes the prior piece's agent-token-specific prescription into a fuller identity-architecture agenda (domain separation, decentralized identity, selective disclosure) spanning both human SSO and AI-agent OAuth access, and explicitly self-references 'a recent post' covering JIT authorization.
- prescriptiveestablishedLeast privilege is even more vital for AI agents than for human users, because agents lack common sense to protect systems from extreme errors.supports ←Podcast: Will Agentic AI Bring Fantasia's Sorcerer's Apprentice to Life?: A Conversation with Tracy Bannon · p2 — Bannon's household key-vs-keychain analogy for individual users reinforces the enterprise-grade prescription that least privilege matters even more for agents than for humans, since agents lack judgment to self-limit damage.supports ←Cloudflare Introduces the Agent Development Lifecycle to Replace Traditional SDLC · p6 — Agrees that least-privilege enforcement matters more for agents than humans, since agents lack the common-sense checks a human would apply before acting.supports ←How to Manage Privilege Drift in Multi-Agent Systems · p5 — Both argue least privilege must be an actively enforced, ongoing runtime property for agents rather than a one-time design-time grant.supports ←Zero to Agent in 30 Minutes: Build a Hermes Social Media Agent with Craig Hewitt · p4 — The corpus proposition argues least privilege is more vital for agents than humans because agents lack common sense; this article's concrete safeguard (separate accounts, limited permissions, traceable access) is a direct practical instance of applying that principle.
- empiricalOne in three AI adopters have already experienced a breach related to AI.
- implicitcontestedThe human-centric design of existing OAuth/token systems is not merely suboptimal for agents but constitutes an active security liability.contradicts ←Cloudflare WriteGuard Brings Fine-Grained Security Controls for MCP Servers · p7 — WriteGuard bets that human-centric OAuth plus contextual tagging is workable for agent attribution, implicitly rejecting the premise that human-centric identity systems are an active security liability for agents.
- implicitPer-request token issuance is technically and economically feasible at production scale.
- implicitcontestedAgent identity is a solved or solvable problem — you can reliably distinguish one agent from another and from the human principal it serves.contradicts ←Podcast: Will Agentic AI Bring Fantasia's Sorcerer's Apprentice to Life?: A Conversation with Tracy Bannon · p15 — I3 treats agent identity as a solved or solvable problem; Bannon's anecdote of a real exploit succeeding specifically because the agents involved 'didn't have identity being tracked' is a concrete counter-instance.
Arguments
Token handling must evolve from static to runtime evaluation for AI agents. strength: medium
Explicit premises:
- Traditional tokens grant broad, session-long access (E2)
- AI agents act unpredictably and may operate for long, unbounded sessions
- 21% of breaches already stem from credential abuse (E1)
Implicit premises:
- The attack surface grows with the number and autonomy of token-bearing agents, making existing breach rates an underestimate for agentic systems.
Context-aware, per-call authorization is the correct design pattern for agentic token handling. strength: medium
Explicit premises:
- Agents lack the common sense to self-limit their actions (E6)
- Without context, authorization is either too permissive or too restrictive (E4)
- Emerging protocols (MCP, Arazzo, A2A, ANP) are adding identity and intent metadata to agent interactions
Implicit premises:
- The metadata provided by emerging protocols is rich enough to support per-call authorization decisions without unacceptable latency.
Without evolved token handling, a single rogue or misdirected agent could cause catastrophic damage. strength: medium
Explicit premises:
- The travel-agent example shows an agent could buy every seat on a flight with a broad token
- Bad actors could hijack long-lived tokens to act through the agent
- Agents may misinterpret prompts and take unintended large-scale actions
Implicit premises:
- Organizations will deploy agents with access to high-value operations (purchasing, data export) before security practices catch up.
Narratives
- Security has moved from network perimeters to identity, but the next shift is from session-based identity to continuous, per-call authorization — and AI agents are the forcing function.
→ Frames the four prescriptions as the next inevitable step in a long-running security evolution - The UNC6395 breach and Verizon statistics open the article and set an urgent tone: credential abuse is already rampant, and adding autonomous agents to the mix makes the status quo untenable.
→ Creates urgency and legitimacy for the prescriptive sections that follow
Questions addressed
- ✅ Why is traditional token handling inadequate for AI agents?
Because agents act unpredictably, run long sessions, and lack human common sense, making static session tokens a liability. - ✅ What specific properties must token systems have in the agentic era?
Runtime evaluation, context-dependence, short-lived issuance, and minimal scope. - ⭕ How do emerging protocols (MCP, Arazzo, A2A, ANP) relate to the token-handling problem?
Mentioned as providing identity and intent metadata, but maturity and interoperability are not assessed. - ✅ What could go wrong if agents are granted broad, long-lived tokens?
Illustrated via travel-agent scenario: token hijacking or prompt misinterpretation could cause large-scale unauthorized actions.
Gaps
- unstated assumptionNo discussion of the performance and cost implications of per-request token issuance at scale.
Read next: Research on token-service throughput benchmarks and latency budgets for per-call issuance - open problemAgent identity is treated as a given rather than an open problem. Reliable agent identity is a prerequisite for context-aware authorization, yet current standards (including MCP) do not fully specify how to authenticate and distinguish agents.closed byPodcast: Will Agentic AI Bring Fantasia's Sorcerer's Apprentice to Life?: A Conversation with Tracy Bannon — That gap notes agent identity is 'treated as a given rather than an open problem' with no standard fully specifying agent authentication. Bannon supplies a concrete real-world incident -- a Claude-based exploit that executed a lateral security hop via an uploaded agent file, succeeding precisely because the agents involved lacked tracked identity and governance -- turning the gap's abstract concern into a documented case.
- missing evidenceNo agent-specific breach data is presented; all cited breaches involve human credential misuse. The extrapolation from human-credential breaches to agent-credential risk is plausible but unsubstantiated.closed byBreaking: Autonomous Agents are a Shitshow — Supplies the missing agent-specific breach evidence: 91% tool-chaining vulnerability, 94% memory-poisoning vulnerability, and the OpenClaw/Moltbook incident compromising 770,000 agents.
- biasThe article is partly a promotional vehicle for Curity's Access Intelligence product but does not disclose the commercial relationship or compare alternative solutions.
Closes gaps elsewhere
- The Future Of Software Engineering · g3 — Supplies the concrete agent-security architecture the retreat lacked: runtime context-dependent authorization, per-request short-lived tokens, agent identity, and least privilege — zero-trust applied to agents.
Related documents
- Podcast: Securing AI Agents: Identity, Authorization, and the DPACT Framework
- 5 Signs That Authenticated API Traffic Is Actually Malicious
- AWS Launches Amazon GuardDuty Investigation Agent to Automate Threat Triage
- The Claude Code active attack didn't stop. 294,842 secrets stolen from 6,943 machines. It evolved and now spreads through Python too and uses Claude Code itself to steal your secrets. The risk to your credentials just got bigger.
- Indirect Prompt Injection Exploits GitHub's AI Agent to Leak Private Repository Data
- GKE Security Blueprint Joins Growing List of Cloud AI Frameworks
- How to Manage Privilege Drift in Multi-Agent Systems
- Article: Agentic Fitness Functions: Extending Evolutionary Architecture Beyond Deterministic Rules
- Your AI agent just blamed the network team. Now what?
- How AI Swarms Are Disrupting Democracy