The Evolution of AI Work: From Chatbots to Persistent Coworkers
Over just three years, AI-driven work has progressed through distinct waves, each introducing new security challenges. The first wave involved session-scoped chats, where risks were limited to what the model said. The second wave brought task-scoped agents, where the concern shifted to what the model did. Now, we are entering the third wave: truly persistent AI coworkers that operate continuously and independently, fundamentally altering the access and identity landscape.
This shift is not theoretical. Industry leaders are already using language that reflects this future. Microsoft refers to agents as "digital colleagues," and OpenAI's Sam Altman outlined the vision for virtual coworkers as early as February 2025. That vision is now becoming real, demanding a reevaluation of how we secure AI in the enterprise.
Why Persistence Changes Everything
Persistence transforms AI agents from temporary tools into standing entities with ongoing access needs. Unlike earlier models where human approval could gate each action, true AI coworkers cannot rely on constant human-in-the-loop reviews. They must be able to request and receive additional access autonomously when needed for their tasks.
Currently, most organizations provision AI agents using OAuth grants, in-session hand-offs, or service accounts — methods designed around human users. These approaches place humans as the primary identity holder, making it difficult to distinguish agent actions from human ones in logs and creating a mismatch between access and accountability.
As a result, AI agents often inherit full standing privileges that were sized for human users, with no clear owner and no automatic off switch. This creates a persistent privilege problem similar to, but potentially worse than, the access creep seen in human identity governance.
The Access Creep Problem Is Worse for AI
For humans, access creep — the gradual accumulation of unnecessary permissions — is a long-standing challenge in identity governance. For AI coworkers, this issue is amplified. Agents operate at machine speed, can discover and attempt to use new tools at runtime, and may combine multiple reasonable grants into an expansive, unintended reach.
Moreover, when AI acts under a user's borrowed credentials, audit trails typically record the human as the actor, obscuring true responsibility. This not only undermines security monitoring but also places an unreasonable burden on people, who must constantly approve actions in a model that assumes human availability for consent screens — a burden that grows unsustainable as agent numbers increase.
What a Useful AI Coworker Actually Needs
Tara Seshan, who leads product for ChatGPT Work and Codex at OpenAI, emphasized on Lenny's Podcast in August 2026 that model intelligence alone is insufficient. An agent's usefulness depends on "meat and potatoes tactical" work: access to data, cloud infrastructure, and reliable tools. As she put it, hiring a colleague and locking them in a room without access to Google Docs, Slack, or the company database renders them ineffective — the same applies to isolated cloud agents.
Seshan also noted that useful agents spawn sub-agents to parallelize work and may eventually collaborate across teams. These advanced workflows assume an identity model where each agent has its own credentials — a model that does not yet exist in most deployed systems.
Current Platforms Fall Short on Agent Identity
The two most widely used agent platforms — Anthropic and OpenAI — do not issue agents their own credentials in their hosted chat products. Neither supports the OAuth client credentials grant, and ChatGPT connectors explicitly reject service accounts and JWT assertions. While developers can hand agents static bearer tokens via APIs, this approach lacks proper identity lifecycle management and creates standing privileges.
In contrast, Google demonstrated a promising model at I/O in May 2024 with its Workspace agent "Chip," which had its own Workspace account, defined role, configured permissions, and clear objectives. Despite this, Google — like its competitors — has not shipped agentic experiences where coworkers have independent identities. Instead, shipped agents continue to inherit human authority, perpetuating the identity gap.
Platform Vendors Are Responding — But With Limitations
Some vendors are beginning to adapt. Microsoft introduced Entra Agent ID, offering first-class agent identities with a named human sponsor. Okta added agent identities to Universal Directory, featuring short-lived, scoped tokens and revocation paths. SailPoint and CyberArk have comparable offerings.
However, these solutions tend to secure agents only within their respective estates. For organizations seeking platform-agnostic control, identity remains the critical checkpoint where policies can be enforced, since identity governs access to every action.
Five Steps to Secure the Third Wave of AI
To address these challenges, organizations should take the following actions:
- Find the shadow coworkers: Detect unregistered agents by monitoring authentication traffic, as registration only captures those that were intentionally logged.
- Give every persistent agent its own identity: If an agent authenticates as a human, downstream controls cannot distinguish it, and investigations cannot accurately attribute actions.
- Record a human owner: Orphaned agents with live credentials are a leading source of standing privileges; assigning ownership enables accountability.
- Scope access to the agent, not the person: An agent that reads Jira should not automatically inherit rights to write to cloud systems just because its initiator had those permissions.
- Define expiration conditions: Digital coworkers are not tied to projects, so they should not be treated as immortal. Set clear rules for expiration based on team changes, employee departure, or idle periods.
What the Third Wave Demands of Security
The security focus has evolved with each wave. In wave one, where risk came from model output, defenses centered on prompt filtering, guardrails, and output classification. In wave two, with action-based risk and human-in-the-loop processes, the emphasis was on access controls and approvals.
Wave three removes the human from the loop but leaves persistent access in place. The pressure is rising as agents begin to spawn sub-agents and collaborate across teams. In such scenarios, handoffs between AI coworkers are only governable if each agent holds its own identity.
As Seshan's observations confirm: the route to a useful coworker runs through the same systems a human employee touches. Without proper identity, even the most intelligent agent is ineffective — and insecure.
How Token Security Addresses the Challenge
At Token Security, we identify AI agents and MCP servers in your environment — including those never registered — by analyzing OAuth grants, API keys, and login traffic. We assign each agent its own identity, designate a human owner, apply appropriate scopes, rotate credentials, and automate retirement when the owner leaves or the agent remains idle.
Our solution spans cloud and SaaS systems holistically, not limited to a single vendor's ecosystem. To learn how many of your agents are running on borrowed human credentials, book a Token demo.
Source: BleepingComputer