The Agent Identity Problem: Non-Human Identities Outnumber Humans 45 to 1 and AI Agents Are Making It Worse

This report describes an emerging, high-impact identity crisis where non-human identities (NHIs) outnumber humans roughly 45:1 and agentic AI is accelerating credential sprawl and exploitation; legacy IAM tools and processes cannot keep pace, leading to widespread exposed secrets, vulnerable MCP servers, critical agent-framework CVEs, and real breaches (e.g., Salesloft-Drift, Vercel). It quantifies adoption vs governance gaps (e.g., 83:1 agent-framework vs security-tool downloads), rapid attacker exploitation timelines (average 17 minutes for exposed AWS credentials), and recommends short-lived, scoped credentials, credential brokers, and treating MCP servers as first-class attack surfaces.