- IBM targets rogue AI agents with identity controls designed to limit access and provide a kill switch
- The move to put agents on a short leash comes as enterprises confront agent sprawl
- IBM’s AI agent governance push extends beyond its own stack, with AWS and Azure in the picture
Spinning up agents and setting them to work is the easy part. Knowing which ones are running, what they can touch and how to cut them off when they go rogue? That’s the problem IBM is trying to tackle with updates to its HashiCorp Vault platform.
“If an agent is going rogue or spending too much money, how do we identify that? How do we stop it in real time?” Tyler Lynch, Outbound CTO for Automation at IBM, said during a call with media. “These are the challenges that our customers talk to me about every single day.”
The risk isn’t limited to malicious action. Lynch pointed to recursive loops that could rack up $10,000 a day in spending or burn through an entire year’s AI token budget before a retrospective cost review catches the problem. That makes oversight while agents are running, rather than just checks before deployment, a critical capability.
IBM is tapping into the HashiCorp assets it acquired last year to address the problem. The company is extending HashiCorp Vault, which already managed the credentials humans and businesses use to access applications, to AI agents. Through Vault, agents will be assigned short-lived credentials that allow them to only do what they need to. IBM is also rolling out Vault Agent Identity to keep tabs on who owns each agent, what authorization it has and its lifecycle status.
The goal is not just to keep agents from reaching systems they shouldn’t, but to establish who authorized their work and leave an audit trail when something goes wrong.
“You can't govern what you can't see,” Lynch explained.
Giving agents an identity — and an off switch
IBM’s updates come at the dawn of the AI agent boom. Gartner has predicted that by 2028 the average Fortune 500 company will have more than 150,000 agents in use, compared to 15 agents per person in 2025.
As Lynch pointed out, managing agents is very different from managing employees, especially at this kind of scale.
“All the patterns and practices and the tools that we had previously for managing access and human identity don't work as well when we have agent identities moving at agent speed,” he said.
This sprawl – and the corresponding security and governance issues it raises – is top of mind for enterprises.
“As CIOs and IT leaders see an explosion of AI agents across their organizations, many are contending with an ungoverned sprawl of agents that expose their organizations to a range of risks, including misinformation, oversharing and data loss,” Gartner Senior Director Analyst Max Goss noted in April.
Indeed, a recent SAP LeanIX report found that while 98% of enterprises said they’ve deployed or plan to deploy AI agents, less than half had access to an inventory of agents.
Lynch said the challenge starts with how easily business users can now launch agents without understanding the security implications. If an agent simply borrows a person’s credentials, enterprises can struggle to distinguish the employee’s actions from the software’s.
That’s where the identity management and access controls in HashiCorp Vault can help.
The permissions granted through Vault aren’t a one-and-done authorization. Lynch said access should be evaluated on every outbound request, even when an agent has been assigned a task lasting weeks. And if an agent tries to do something beyond the scope of its authorization, that action is flagged to a human, who can then revoke an agent’s session, effectively kicking it offline.
IBM’s agentic controls in action
In a healthcare demonstration, Lynch showed an agent receiving access scoped to a single patient’s record rather than broad access to the database. A request for a more sensitive record triggered an approval prompt on a human’s phone. Denying that request revoked the agent’s session under the configured policy.
That control layer matters. In scenario Lynch shared, a prompt injection or jailbreak would not automatically give the agent permission to retrieve other patients’ records.
Of course, identifying rogue agents requires visibility beyond an agent registry. Lynch said IBM uses network telemetry, including cloud flow logs and identity-provider traffic, to identify agents and monitor their operations against policies. IBM is also working on controls across operating systems, compute and storage, aiming to detect suspicious activity below the software directing an agent’s work.
IBM is pitching these controls as an addition to customers’ existing technology, not a reason to replace it. The healthcare demonstration used Amazon’s AgentCore runtime alongside IBM’s identity and credential controls. Lynch also said watsonx Orchestrate would gain the ability to manage agents from Amazon Bedrock and Azure, extending oversight beyond agents running on IBM’s own platform.
Read more about AI agent governance and orchestration on Fierce Network
Agentic orchestration is the next big AI hurdle for telcos
Enterprise AI needs goals, governance and cheaper models
AI governance gap widens as enterprises race to deploy agentic AI, IBM warns