COMMENTARY: Your organization spent 10 years killing off static credentials and unsigned binaries.Then it adopted AI, and both came back inside a quarter.This is not an argument against enterprise AI. It is an observation about how it gets deployed. The security conversation around AI has been dominated by model behavior — prompt injection, jailbreaks, hallucination. Meanwhile the plumbing underneath is being wired with patterns we spent a decade removing from everything else.Three regressions are worth your attention, and all three sit in the identity and cryptography layer rather than the model layer.
1. Long-lived static credentials came back
The public certificate world is moving hard in the opposite direction. Maximum TLS certificate lifetime drops to 200 days in March 2026, 100 days in 2027, and 47 days in 2029. The entire industry is being pushed toward automation and short-lived credentials.Now look at how AI tooling gets connected to your systems.Agents reach enterprise data through connectors and tool servers, and those are frequently configured with static API keys, shared OAuth client IDs, and long-lived tokens sitting in configuration files. The Model Context Protocol ecosystem has documented exactly this class of problem: token passthrough, where a server forwards a bearer token upstream without checking who it belongs to, and confused-deputy conditions, where a shared client identity lets one caller inherit permissions meant for another.There is a structural issue too. A tool server that brokers access to a dozen systems becomes a credential concentration point. Compromise it once and you inherit every scope it holds.So we now have workloads with broad, standing access, authenticated by secrets that never rotate — at the exact moment we are re-engineering the rest of the estate to eliminate that pattern.2. We started loading unsigned artifacts again
Software supply chain security took 15 years and a series of painful incidents to get right. Sign the artifact. Verify before execution. Know who built it.Then model weights arrived, and much of that discipline did not travel.The common PyTorch serialization format uses Python's pickle, which executes code during deserialization. Loading a model is running code. In February 2025, ReversingLabs documented malicious models on a public model hub using a technique they called nullifAI, which evaded the hub's scanner by using non-standard compression and deliberately broken pickle files. The payload opened a reverse shell.Verifying integrity and provenance for models is a solved problem on paper. The OpenSSF Model Signing specification, published in 2025, defines detached signatures for model artifacts, with Sigstore-style identity-bound signing and a public transparency log. NVIDIA signs models published through NGC. Google uses the same approach for models on Kaggle.The gap is enforcement. Signing exists. Verification before load, as a gate rather than a suggestion, is rare.3. Secrets are being moved into systems designed to remember
The OWASP Top 10 for LLM Applications lists sensitive information disclosure at LLM02 and vector and embedding weaknesses at LLM08. Both matter here, and both are underappreciated by crypto teams.A key pasted into a prompt does not stay in the prompt. It lands in request logs, traces, evaluation datasets, caches, and sometimes an embedding in a vector store that outlives the conversation by years. Retrieval systems are built to remember and resurface. That is the product.Treat the context window as a logging surface, because that is functionally what it is.The identity problem underneath all three
Here is what makes this genuinely hard rather than merely sloppy.An AI agent is not a user, and it is not a service. It acts on a person's behalf, with that person's authority, at machine speed, and it decides at runtime which tools to invoke. Our identity models assume either a human at a keyboard or a workload with a fixed, declared purpose. An agent is neither.That is why OWASP put excessive agency at LLM06. Delegation is the whole point of an agent, and delegation without scoping is how one compromised prompt becomes a data exfiltration path.What to do about it
Five things, and every one uses controls you already own.- Issue agents short-lived workload credentials, not API keys. If your PKI can automate 47-day certificates, it can issue 15-minute agent credentials. Ask why it is not.
- Scope per agent, per user, per tool. No shared client identities across callers. If a tool server cannot tell you which principal an action was taken for, it cannot be audited and it cannot be revoked precisely.
- Gate model loading on signature verification. Enforce it at deployment, the way you enforce signed container images. Prefer serialization formats that do not execute code on load.
- Keep key material out of context. Secrets go through a broker at call time, never into a prompt, and never into anything that gets logged or embedded.
- Inventory which agents hold which credentials. You cannot revoke what you have not mapped, and agent credentials are proliferating faster than anything in your certificate estate.
