Most of the AI-security conversation is fixated on the model: jailbreaks, prompt injection, the next clever demo of an agent being talked into misbehaving. Those risks are real. But the failure that actually scales is older and more boring — and it has nothing to do with how clever the model is.
The moment you connect an agent to tools through MCP, you have created a new identity: something that authenticates, gets permissions, and acts on systems on your behalf. The security question is not "can the model be tricked?" It is "what is this thing allowed to do, as whom, and for how long?"
The blast radius is identity, not the model
Here is the number that should reframe how you think about agents. Non-human identities — service accounts, API keys, workload identities, and now agents — already outnumber human identities by roughly 144 to 1, a 56% year-over-year jump in that ratio, across an analysis of more than 27 million non-human identities (Entro Security, H1 2025, a vendor report). Agents are simply the newest and fastest-growing class of this population.
Now pair that ratio with how we credential these identities. We hand them long-lived secrets — and long-lived secrets leak, constantly:
| Signal (vendor-reported) | Figure | Source |
|---|---|---|
| Secrets leaked on public GitHub in 2025 | ~29 million (+34% YoY) | GitGuardian 2026 |
| AI-service credential leaks, YoY | +81% (to 1,275,105) | GitGuardian 2026 |
| Secret-leak rate in AI-assisted commits | ~3.2% (≈2× baseline) | GitGuardian 2026 |
| 2022-leaked secrets still active two years later | 70% | GitGuardian 2025 |
Read those together. The population of non-human identities is exploding, AI is accelerating the sprawl, and the credentials we issue them stay valid long after they leak. That is the crisis — and it is structural, not a model flaw.
Why "secure the prompt" misses it
A guardrail written into a system prompt is advisory. It expresses intent, and the model can be argued out of it. That is exactly why prompt injection is unsettling. But notice what makes an injection catastrophic rather than merely annoying: the reach of the identity behind the agent.
The Entro data makes the over-reach concrete: 5.5% of AWS machine identities hold administrator privileges — often by default — and around 9% are overprivileged (Entro H1 2025). An agent that inherits one of those identities does not need to be "hacked." It just needs to be wrong once while wired to a standing key with admin reach.
So the two layers are different in kind:
- The model layer decides whether you get attacked.
- The identity layer decides whether the attack matters.
Only one of those is being neglected at 144-to-1 scale.
A note on the scary headlines
You will see alarming counts of MCP CVEs and tool-poisoning success rates making the rounds. Some may well be true — but I am deliberately not quoting them here, because I could not verify them against a primary source, and a credibility piece should not launder unverified numbers. The argument does not need them. The verified secrets-sprawl and identity-ratio data above is more than enough to justify treating agent identity as a first-class control problem.
Where this series goes
If the blast radius is identity, the fixes are identity controls — and most of them already exist on AWS; agents just have to use them. Over the next three parts:
- Part 2 puts the control point at the gateway, where authorization is enforced before a tool call runs, not asked for politely in a prompt.
- Part 3 retires standing credentials entirely with short-lived, brokered tokens.
- Part 4 is a concrete audit you can run this week against your own account.
The takeaway for now: stop budgeting all your worry for the model. Count your non-human identities, look at how many hold standing admin keys, and accept that your newest, fastest-growing class of them is autonomous. That is the surface that needs governing.
Researched and drafted with AI assistance; every statistic is attributed to its primary source above (GitGuardian and Entro figures are vendor-reported), and a human reviewed before publishing.
I help teams across Asia-Pacific turn ambitious AI ideas into shipped, well-crafted products — pairing deep cloud architecture with a product designer's eye for clarity and trust. I write and speak about applied AI, developer experience, and the craft of building things that last.