The explosion of corporate AI tools multiplies security risks
Companies use an average of more than one AI platform simultaneously, with a mix of approved tools and personal accounts coexisting within corporate infrastructures. Anonymized data collected by Okta from over 20,000 organizations between June 2022 and June 2026 reveal a proliferation of AI tools, each with their own logins and permissions.
Quick Answer
Companies use multiple AI platforms simultaneously, with an exponential growth of approved and non-approved tools. This increase multiplies security risks related to over-permissioned credentials and orphaned tokens. Security teams must manage this expansion as an extension of their "identity fabric".
A clear split between startups and software giants
The Okta Enterprise AI Index classifies vendors into two groups based on the growth rate of their corporate customer bases. AI-native startups like Anthropic, OpenAI, and Cursor have seen their corporate customers more than quadruple. On the other hand, software giants like Microsoft, Google Workspace, Figma, Slack, Adobe, and Notion have registered more moderate growth, while maintaining a broader customer base.
The evolution of AI tools: from autocomplete to autonomous agents
Corporate adoption of AI has gone through three distinct phases. Initially, tools were limited to completing code and answering questions. With the advent of autonomous agents starting in the spring of 2025, tools began executing longer work chains with less human intervention. These advanced systems autonomously navigate through codebases and complete multi-step tasks without constant human prompts.
The proliferation of credentials increases risk exposure
Each new platform introduces additional connections, expanding the security perimeter. AI tools access corporate knowledge through app-to-app links based on secrets and tokens, multiplying vulnerable access points. Fei Liu, Principal Emerging Tech Researcher at Okta, emphasizes that "the increase in the number of platforms coincides with a greater risk of over-permissioned apps and orphaned tokens".
Agents using human credentials: an audit trail problem
Credentials for AI agents often derive from traditional methods such as service accounts, static API keys, and, in some cases, shared human logins. When an agent operates under the identity of an employee, the traceability of actions is completely lost. As Liu explains, "when an agent inherits a human login, it is no longer possible to distinguish whether a critical action was performed by an employee or the algorithm".
The adoption of dedicated non-human identities
The demand for dedicated non-human identities is growing rapidly. These identities should include lifecycle management and specific access reviews, offering more granular control compared to traditional credentials. Okta recommends asking three fundamental questions to each agent: where it operates, what it can connect to, and what it can do.
The problem of shadow AI: unauthorized tool use
A significant portion of AI use occurs outside of IT-approved tools. Employees often create personal instances in personal cloud environments or access unauthorized models through personal accounts. According to Liu, this "shadow layer" is often more extensive than the company-approved footprint.
The risk of uncontrolled data movement
The main risk associated with shadow AI is the uncontrolled movement of sensitive data. If an employee uses a personal account to access an unauthorized LLM model and inserts proprietary code or customer data into prompts, the security team loses all visibility and ability to revoke access.
The importance of a single identity layer
To mitigate these risks, companies should implement a central single identity layer. As Liu advises, "it is essential to create 'paved roads' to integrate the most requested AI tools into SSO and governance processes, so that employees do not feel compelled to bypass IT".
The increase in vendors and agents requires centralized solutions
As the number of vendors, agents, and credentials increases, so does the value of having a single access point to grant, review, and revoke permissions across all platforms in use. This centralized approach is fundamental to maintaining control over an increasingly complex and fragmented AI ecosystem.
The adoption of AI and the transformation of the corporate landscape
The adoption of AI systems is profoundly changing the internal dynamics of organizations. The transition from simple tools to autonomous agents has involved a reorganization of workflows, with significant implications for productivity and security. Companies now have to manage an increasingly complex technological ecosystem, where the coexistence of different platforms requires innovative approaches to maintain operational efficiency.
The challenge of managing multiple vendors
The proliferation of specialized AI vendors is creating a fragmented technological landscape. Companies now have to deal with the management of different tool suites, each with its own characteristics and security requirements. This scenario requires the adoption of more sophisticated governance strategies, capable of coordinating the integration and use of heterogeneous platforms.
The evolution of credentials for AI agents
The problem of shared human credentials represents only part of the challenge. Companies are exploring new solutions for managing non-human identities, with a particular focus on multi-factor authentication systems and immediate revocation protocols. Research is focusing on dynamic identity models that can adapt to changes in the roles and functions of agents.
The impact of shadow AI on corporate culture
The spread of shadow AI is highlighting tensions between technical departments and other business units. Many organizations are investing in continuous update programs to keep the team's skills aligned with the latest innovations. This proactive approach is essential to address emerging challenges in managing the security and integration of AI systems.
The future of non-human identities
The industry is working on standards for non-human identities that could become a definitive solution. These standards could include universal authentication protocols and frameworks for managing the lifecycle of credentials. The adoption of such standards could significantly simplify security management in multi-vendor environments.
The legal implications of using AI agents
The use of AI agents raises important legal questions, particularly regarding responsibility for autonomous actions. Companies are collaborating with legal experts to develop clear policies on responsibility and compliance. This work is crucial to prepare for potential future regulatory challenges.
Integration with legacy systems
One of the most complex challenges is the integration of AI agents with legacy systems. Many organizations are developing middleware solutions that allow secure communication between old and new systems. This hybrid approach is essential to maintain operational continuity during the transition to more modern architectures.
Managing costs in the AI ecosystem
The increase in the number of platforms and credentials also leads to an increase in operating costs. Companies are exploring flexible licensing models and consolidation strategies to optimize expenses. The adoption of unified platforms could reduce long-term costs while maintaining the flexibility needed to meet business needs.
Towards a safer AI ecosystem
The path to a safer AI ecosystem requires a holistic approach that integrates advanced technologies, clear policies, and a widespread security culture. Organizations that invest today in these solutions will be better prepared to face future challenges, ensuring a competitive advantage in the rapidly evolving market of artificial intelligence.
Editorial Note and Disclaimer
The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.
GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not provide real-time information.
The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the improper use of the information published.
In the Crypto sector, every investment involves risks: readers are invited to always inform themselves autonomously before making any decision.