1Password's research finds AI agent adoption is outpacing governance

Summary and key findings

1Password surveyed 500 American IT and security professionals and 500 developers to learn how organizations are adopting and governing AI for their most technical workers.

We found that companies are racing to embed AI agents throughout their systems, but have done so without a security architecture to effectively govern them. The result is a wide gap in visibility and accountability, in which agents access sensitive information and take actions without oversight.

The impact of this agentic governance gap is already being felt in the form of security incidents, work disruptions, and credential misuse. We’ll explore the 1Password AI Agent Governance survey in depth in the blog below, but here are some of the most illustrative and surprising findings:

• Agents are pervasive in production environments:Nearly half (46%) of developers are using AI agents in production environments today. 45% expect to use AI agents in the next two years. In total, 91% are either using agents today or expect to do so in the next two years.

• Agents are accessing sensitive data without proper controls: 71% of all respondents said that AI agents have access to customer data, sensitive IP, or HR information at their companies. Meanwhile, 62% of all respondents report security gaps in how their company manages agents.

• Two-thirds of developers (67%) said agent security has gaps:65% of developers say they’re expected or encouraged to use AI agents, but only 33% say they have a highly secure way to do so.

• Agents are taking unintended actions: 47% of developers have had an AI agent take an unintended action after following instructions embedded in untrusted content (AKA prompt injection). 74% of developers witnessed unintended consequences from the use of AI agents.

Agentic development is colliding with human security

In the world of AI, change happens at unimaginable (in fact, inhuman) speed. And few revolutions have come more swiftly than the agentic era, in which AI agents have been adopted and embedded into companies of every size, in every industry.

In 2022, agents were a concept discussed in research papers. By 2024, they were built and deployed by the first wave of experimenters. Now, 1Password’s research finds that at 89% of American companies, AI agents are required, encouraged, or at least allowed.

This steep adoption curve is simultaneously astonishing and unsurprising. After all, AI agents have been billed as the fulfillment of AI’s true promise: machines that can take on complex tasks with autonomy, interface between multiple systems, and deliver the kinds of workforce efficiency gains that will justify the massive investment in LLMs.

But while speed is part of the appeal of AI (Vibe code an app in an hour! Build an agent in 15 minutes!), the disciplines of security and IT are designed to be more deliberative. The result is a dangerous mismatch, with semiautonomous agents sprinting out ahead of the systems designed to control access and provide visibility into risky or anomalous behavior.

The strain of this mismatch is being felt first and most strongly by organizations’ most technical employees: the developers who are using agents in high-stakes tasks, and the IT and security employees trying to build guardrails for them.

Agentic access is magnifying the effects of credential sprawl

Many organizations are attempting to control AI agents with the same systems they use for their human employees. Thirty-five percent of our respondents said their companies manage AI agents under existing IAM processes. Meanwhile, 21% have not yet formalized an approach to managing agentic access at all.

But treating agents like humans is an inherently flawed approach. One complicating factor is that AI agents share traits of both humans and machines in how they access data and perform tasks. For example, an agent might log into a user’s email through a typical, human login flow, but then connect to their calendar through a backend integration. In either case, the access is likely to depend on different types of credentials. But simply giving raw, long-lived credentials to an agent is unsafe, since the agent could retain, expose, or misuse this information.

At present, when developers want to build integrations between agents and other tools, they often rely on non-human identities (NHIs), like API keys and service accounts. These largely predate the existence of agents but are the underpinnings of all modern software automation. Unfortunately, improperly handled NHIs have been a major security problem for years, but the arrival of agents can multiply the risk.

Our survey found that 71% of respondents use unsecure methods of handling secrets and NHIs. Other findings worth highlighting include:

• A quarter of developers (24%) hardcode credentials

• One in five developers (20%) share credentials through Slack or email

• 43% of developers don’t use a dedicated secrets manager or vault

In your day-to-day work, how do you typically handle secrets like API keys, tokens, or service account credentials? Please select all that apply. (Base: Total respondents, n=1,000)

* Bolding on the numbers indicates a statistically significant difference between IT/security and devs/eng.

Now these practices are being transferred to AI agents. Forty percent of the developers we surveyed grant agents persistent access to systems or credentials, meaning access that is not revoked when a task is completed.

We had a major system outage last quarter because an AI agent was using an expired credential and nobody knew about it until things broke. Tracking it down took forever because our audit trails for non-human accounts are basically non-existent right now, it was a mess." — Senior IC in Network Administration at a mid-sized company

Credential issues with NHIs are rampant; 86% of respondents report credential-related issues with NHIs, and over a quarter (27%) report a security incident or breach from overprivileged identities, which rises to 33% among developers who use AI agents.

Which of the following credential-related issues has your company experienced related to non-human identities specifically?Please select all that apply. (Base: Total respondents, n=1,000)

Interestingly, we found that 64% of respondents use a mix of secure and unsecure methods to manage secrets, meaning that the same developer might store some credentials in a secrets or password manager, and others in a plaintext .env file on their hard drive.

That disconnect probably arises from another mismatch between speed and security. Best practices for secrets management are often cumbersome and complex, while many modern organizations expect their engineers to constantly ship code. When velocity is a mandate and security is a burden, workarounds become inevitable. Jason Meller, VP and Security Strategist at 1Password, agrees.

Security tools have spent twenty years asking people to slow down, and people have spent twenty years saying no. The lesson here isn't that developers need more training. It's that the secure thing has to become the easy thing, or it won't happen at all." - Jason Meller, VP and Security Strategist, 1Password

This phenomenon appears in one of our most striking data points: that 65% of developers say they’re expected or encouraged to use AI agents, but only 33% say they have a secure way to do so.

This points to a technical workforce that knows they’re acting unsafely but lacks the tools, training, and support to do better.

Agents are accessing sensitive data, often without permission

An agent’s value is tightly correlated with what it is allowed to access, but greater access entails greater risk, particularly if that access is not easy to observe or revoke. Seventy-one percent of respondents report that AI agents have access to sensitive data such as customer information, IP, and HR data.

Many organizations have attempted to set limits around the types of data agents can interface with, in the interest of both security and regulatory compliance. Yet we found that AI agents are accessing unapproved data at 41% of organizations. The types of data vary, but across the board, agents are accessing roughly twice as much as they are approved to access.

We had an AI agent pull data from the wrong system due to overly broad access permissions, which caused some inaccurate reporting that took us a while to track back to the source. — Executive leader in IT Operations at a mid-sized company

Unfortunately, no one can truthfully offer more than a best guess about what systems AI agents are accessing and what actions they’re taking, because visibility into them is so poor. What employees tend to agree on is that there are known unknowns. Sixty-two percent of respondents say there are gaps in how their company manages AI agents. Curiously, this is one of the few questions where IT and security respondents meaningfully differed from developers. In this case, 67% of developers reported gaps in agent management, compared to only 57% of IT and security professionals.

Elsewhere, we found that 71% of respondents report visibility gaps into which agents are using credentials. Tellingly, even among respondents who say their company’s approach to agents is “highly secure,” half (50%) report visibility gaps into credential usage. Beyond that, a third (33%) of IT and security respondents say they have no idea how many NHIs or agents are being used at their company.

The consequences: breaches and disruptions

We asked respondents whether they agreed or disagreed with the following statement: “I've had an AI agent take an unintended action after following instructions embedded in untrusted content (a webpage, document, email, or tool output).” Almost half (47%) of developers said they had experienced this phenomenon, otherwise known as prompt injection.

“This result is alarming, but it also tracks with our own independent research,” says Meller. “Our testing found that models are near-perfect at recognizing phishing, but recognition doesn’t make an agent stop in the middle of a task. Often the agent isn’t even being tricked into disobeying instructions, it’s just faithfully following a request that leads somewhere dangerous.”

Respondents also reported other adverse effects. Among developers who use AI agents, 28% reported inaccurate outputs, 20% experienced workflow disruption, and 19% encountered data leaks or privacy issues. All in all, 74% of developers shared unintended consequences or issues they’ve seen from AI agents.

So who is accountable when agents take these adverse actions? Tellingly, there is no consensus. We asked our respondents two questions on the subject of AI accountability:

1. In practice at your company, who is ultimately held accountable for the actions or behaviors of AI agents?

2. Regardless of how things actually are at your company, who do you think should be held accountable for AI agents’ actions or behavior?

The results of the first question were all over the map. Twenty-four percent said team/department leadership was responsible. Nineteen percent said it was the person using the agent. Seventeen percent said it was the company’s leadership, 13% said it was the company’s security team, while an alarming 5% said the agent itself is held accountable.

But even more fascinatingly, the question of who should be held accountable was just as chaotic. Regardless of who a respondent thought was accountable in practice, 65% said a different personshould be held accountable.

What teams need to safely expand agents

When we asked respondents what they would need to confidently expand their use of agents, only 5% replied that they didn’t need anything and were already confident.

The remaining 95% converged on security improvements that would increase their confidence in AI agents:

• Knowing what agents are accessing (52% wanted a centralized view of access across humans and agents)

• Controlling the scope and duration of that access (47% wanted just-in-time credentials that expire after each task)

• Attributing actions back to a specific agent and the person who authorized it (51% wanted a complete audit trail and 53% wanted clear accountability for each agent's actions)

These are governance capabilities most organizations lack today, and that 67% of developers acknowledge they're missing.

We also asked respondents who don’t personally use AI agents at work why they refrain, and “security or data privacy concerns” was the top answer at 44%.

If you’re a leader who wants your engineers to start enthusiastically using agents, then you should treat those answers as a mandate. Your employees are telling your what they need.

Developers and IT and security professionals are demanding visibility into agents and NHIs. And true visibility requires discovery that goes beyond IT-sanctioned applications and surfaces the access hiding in the gaps between governed systems.

Likewise, IT and security teams must have the ability to secure agents via purpose-built access controls and governance. Attempting to adapt existing tools and policies to agentic actors will lead to more standing access, overprivileged NHIs, and confusion. What is needed is just-in-time, task-scoped access that continuously evaluates requests against policy, and expires when a task is complete.

Finally, teams need full auditability with attribution: who approved what, in what system, and on behalf of whom, across humans, AI agents, and machine identities.

Ultimately, these results show that the agentic genie is out of the bottle and there’s no putting it back in, especially for highly technical employees who have already deeply embedded agents into their workflows. But it’s not too late to build proper security for these tools, and determine just what kind of genie we want it to be.

1Password is building secure access for humans, AI agents, and machine identities. Learn more about 1Password Unified Access.

1Password conducted this study using an online survey prepared by KW Research and distributed by PureSpectrum, completed by n=1,000 full-time employees in the United States at firms with at least 250 employees. The sample was evenly split between IT/security roles and developer/engineering roles. A range of firm sizes, seniority, and industries are represented. Data was collected from May 26 to June 3, 2026.