Teleport CEO: AI agents need a new identity model to avoid security disasters

In the article, dated Sept. 1, 2026, the CEO said AI agents are now executing code, applying policies, and managing DevOps functions inside core infrastructure, but projects often stall because the security models they are wired into were designed for a world that no longer exists. The CEO cited an incident in which an agent deleted a company's entire production database and its backups in nine seconds.

The piece said identity systems were built for two kinds of actors — humans and machines — but agentic AI now represents a third type. Treating agents as ordinary microservices with broad privileges, a common workaround, makes each agent a potential source of compromise and allows it to execute thousands of actions across infrastructure in seconds, the CEO wrote.

Legacy IAM tools are breaking down under this pressure, according to the article. Engineers face a flood of activity logs from agents, but cannot contain them before unauthorized changes are made. Enforcing strong authentication across every tool would require building individual integrations for each part of the stack, making AI difficult to scale. As a result, engineering teams are forced to manually stitch together IAM, infrastructure, and secrets, with no consistent identity or visibility into agent actions.

The CEO cautioned against creating a separate tool to manage the third identity type, arguing that would double the work for engineers, require rebuilding identity policies from scratch, and introduce greater anonymity that could help attackers. The better approach, the article said, is to eliminate anonymity entirely by giving every actor — humans, machines, workloads, and AI agents — first-class identities cryptographically secured by a hardware root of trust. Static credentials such as API keys and passwords should be removed to avoid credential sprawl and secrets theft.

Agents should follow zero-trust principles and operate with short-lived privileges tied to specific actions authorized by a human user, with the privilege attached to the action rather than the actor. For example, an agent generating code would inherit its mandate from a human owner with matching authority, restricting access to only the data tables needed for that task. The article also called for containing non-deterministic actors in a trusted execution environment.