Most of OWASP's ten non-human identity risks apply to AI agents, because an agent runs on tokens, keys and service accounts rather than a person's login. The closest fits are improper offboarding, secret leakage, overprivilege, long-lived secrets, environment isolation, reuse and human use of an agent's credential.
The ten risks
OWASP publishes a 2025 Top 10 for non-human identities, often shortened to NHI. The list, in order, is improper offboarding, secret leakage, vulnerable third-party NHI, insecure authentication, overprivileged NHI, insecure cloud deployment configurations, long-lived secrets, environment isolation, NHI reuse and human use of NHI.
An AI agent is a non-human identity with a twist: it chooses its own actions at runtime, so a weak credential does more damage.
Mapping to agents and MCP
The right hand column is our reading of how each risk applies. OWASP supplies the risk names, not the agent examples.
| Risk | How it can show up with agents | Check |
|---|---|---|
| NHI1 Improper offboarding | A retired agent keeps live tokens | Revoke on retirement |
| NHI2 Secret leakage | Keys in prompts, configs or logs | Scan configs, redact logs |
| NHI3 Vulnerable third-party NHI | A connector or server you did not write holds your access | Review each integration |
| NHI5 Overprivileged NHI | Broad scopes on a tool server | Cut scopes to the task |
| NHI7 Long-lived secrets | A static key in an MCP config | Short lived tokens |
| NHI8 Environment isolation | Same credential in test and production | One identity per environment |
| NHI9 NHI reuse | Several agents share one account | One identity per agent |
| NHI10 Human use of NHI | A person logs in with the agent's credential | Separate human and agent access |
What the risks have in common
Four of them come down to scope and lifetime: overprivilege, long lived secrets, reuse and environment isolation. Fix those with narrow, expiring, per agent credentials and you remove a large share of the risk.
The other group is lifecycle: offboarding, leakage and third party exposure. These need an inventory and an owner, because you cannot revoke what you cannot list.
A one hour exercise
- List every agent and MCP server in use, with an owner for each.
- For each, write down the credential type, scope and expiry.
- Flag shared credentials and ones with no expiry.
- Replace the worst three with scoped, expiring ones.
- Add a retirement step to your agent lifecycle.
Safeguard includes agent identity, which records which agent holds what access, and asset discovery to build the inventory. A free scan is at https://gold.safeguard.sh/scan.
Quick check
Are all ten risks relevant to agents?
Most are, in some form. We left out insecure cloud deployment configurations and insecure authentication from the table only for space, and both still matter.
Where do I start?
Start with inventory and ownership, then shorten credential lifetimes. Both are cheaper than adding new tooling.
Sources
Last reviewed: 19 October 2026.
