An AI agent borrows your credentials. An AI coworker never gives them back.
By Itamar Apelblat, Co-Founder and CEO, Token Security
We no longer have the luxury of adapting to change over several years. The fundamental shift in AI-driven work keeps morphing month after month, so much so that in just three years we've already experienced distinct waves of work-related AI, and another one is no longer on the horizon but right around the corner.
First came the session-scoped chats, where the risk was what the model says. Then came task-scoped agents, where the risk is in what the model does. Broadly speaking, that's where we are now, but the goalposts are already elsewhere. Truly persistent AI coworkers are nearly here, and with them, the dissolution of current access models.
As with so much in this space, you can see that's where the AI companies want to go by their vocabulary. Microsoft talks about agents as "digital colleagues," and OpenAI's Sam Altman outlined the plan for virtual co-workers what seems like a lifetime ago, in February 2025.
That vision is now becoming a reality, and we need to adapt our security models to address fundamental differences in how AI colleagues work.
Persistence changes everything
You should plan for this sooner rather than later. For a few years, we were able to pigeonhole AI into existing access models, but a "true" coworker that works independently requires a different way of thinking.
Agentic co-workers will require access front-loading or a more machine-friendly (yet secure) way of provisioning it, as approving actions on a case-by-case basis only works if there's a human available to review. True digital co-workers can't rely on regular approvals for everything but should be able to request additional access when it's needed for their tasks.
Currently, provisioning identities purpose-built for AI agents is still far from being the norm. The standard is to use OAuth grants, in-session hand-offs, and service accounts. The first two options usually place humans as the primary entity; the third one is rarely created specifically for agents.