Gartner: by 2028, 90% of firms sharing credentials with AI agents will need to redesign

The article explains that as AI agents become more common, they need to call many APIs, which leads to a proliferation of credentials like API keys and access tokens. Traditional methods such as storing keys in .env files and passing them to agents are no longer sufficient, as they can lead to leaks and insider threats. The article mentions that tool poisoning and indirect prompt injection are new attack methods emerging with AI agent use.

To address this, the article recommends a three-layered approach: secure credential storage, dynamic token issuance with scoping, and auditing access. It highlights tools like secret managers and token vaults, including Infisical, HashiCorp Vault, Nango, AWS Secrets Manager, 1Password, Aembit, WorkOS, and Arcade. The key is to avoid giving credentials directly to agents, but instead have them request tokens from a secure server-side component, with human-in-the-loop approval for critical operations.

Gartner's prediction underscores the urgency: by 2028, most organizations that share human credentials with AI agents will need major redesigns. The article suggests that the real question is not whether API keys are stored safely, but whether AI agent actions can be controlled. This likely means that organizations will need to invest in proper credential management and auditing to avoid security and compliance failures.