Credential with no Owner

India's enterprises are now issuing logins to software that acts on its own, and neither the security industry nor the observability industry can point to what happens when one is stolen.

Sometime before 24 July, someone got into a Bank of Baroda employee's email account. What followed never touched the bank's core systems, where the accounts and the money live. It did not need to. By the end of the month a group calling itself TripleX had listed more than a terabyte of data it claims to have taken from India's second-largest public sector bank on a dark-web leak site. It published the data free, rather than asking to be paid. Researchers who crawled the leak site catalogued 162,111 files totalling roughly 1.07 terabytes, reporting customer identity documents, loan papers and internal audit records among them; the bank has confirmed only that an employee's email account was compromised, that certain internal files were accessed, and that core banking systems were not.

That was a human being's login: one password, one person, one mailbox, used at human speed during working hours, and, at most banks, a second factor on a phone standing behind it.

Indian enterprises are now handing logins to software.

A login with no one behind it

Every AI agent deployed inside a company, whether to read email, reconcile invoices, query customer records, or write and push code, authenticates the way an employee does: with a credential. The resemblance ends there. An agent's credential has no phone behind it, because there is no person to hold one. It operates at machine speed, so the window between compromise and consequence compresses from days to seconds. It has no working hours; a service account's baseline is always-on, which means there is no unusual 2 a.m. login to notice. It is routinely granted broader permissions than any individual would get, because scoping precisely is fiddly and granting broadly makes the pilot work. And it chains: agents call tools that call other agents, so one credential can reach further than any single mailbox ever did.

The speed asymmetry is not theoretical. Researchers tracking exposed cloud credentials find that attackers begin using them within roughly seventeen minutes of exposure, while a quarter of organisations take more than a day to rotate a key they know has leaked. The population is not small either. KPMG's 2026 cybersecurity assessment puts the ratio of machine identities to humans above eighty to one in the average enterprise.

If one human login at one bank could produce a terabyte, the arithmetic of the non-human kind writes itself.

The next wave, says the guard

Diwakar Dayal, managing director, India and SAARC, SentinelOne

"AI-led attacks or agentic attacks are the new ransomware of 2026. We are in the early days of those attacks, and we also have the early days of the defence."

The security industry has noticed. Diwakar Dayal, managing director for India and SAARC at SentinelOne, has spent much of this year warning about exactly this. Taking over AI identities, or as he put it in an interview, "the credentials, the tokens, the permissions," is in his words "the next wave." He goes further: "AI-led attacks or agentic attacks are the new ransomware of 2026." He is candid about his own exposure. He runs AI agents with access to his email and Slack, and notes that an attacker who cloned such an agent or took its credentials could "exploit the agent itself, which is far more dangerous," because the agent's privileges make everything easier from there.

A framework, not yet a mechanism

Ask what would actually stop this, and the answer is a framework rather than a mechanism. Dayal's prescription is Zero Trust, the decade-old doctrine of trusting no identity and re-verifying continuously, extended to agents, which he describes as "created once, but present everywhere." Verifying a person continuously draws on signals: the device, the location, whether the behaviour looks like them. A token has no body, no phone, no habits. What the equivalent signals are for a credential with no owner is a question the industry is still answering in the future tense.

The tooling is candidly behind. In a 2026 Cloud Security Alliance survey, 92 per cent of respondents said their existing identity and access management tools cannot manage AI and non-human identity risk, and half reported that nobody in the organisation clearly owns agent identities at all. Barely a quarter said they could trace an agent's actions back to the human who sponsored it across every environment. A separate CSA finding is starker still: most organisations cannot reliably tell AI agent activity apart from human activity in their own logs.

Nor is the connective tissue any better. In a study of nearly 8,000 live Model Context Protocol servers, the emerging standard for letting agents reach enterprise tools, roughly 40 per cent required no authentication whatsoever.

The instrumentation is not in place either. In research Dynatrace published this week, only 40 per cent of platform engineers said they embed observability across every deployment stage, and 37 per cent named integrating with existing tools as their single biggest challenge. The watching, in other words, is partial even for the systems enterprises have been running for years.

Asked whether SentinelOne has seen an agent act outside its authorisation at an Indian organisation, the company characterises the risk as an industry-level observation rather than pointing to any specific customer, geography or incident.

The watcher has seen nothing

Arun Balasubramanian, managing director, India and SAARC, Dynatrace

"The cost of going wrong is too expensive, so they are doing it the right way upfront; enterprises are going in a controlled deployment phase."

The other industry watching this space sees even less. Dynatrace, whose software observes how enterprise applications, increasingly including AI agents, actually behave in production, says it has not observed such an incident among its Indian customers. Arun Balasubramanian pushes back on the premise that Indian enterprises are stumbling into agent deployments at all. "Enterprises are going in a very, very controlled deployment phase," he said in an interview, describing large Indian customers, most of them regulated, as keeping "humans in the room" precisely for "auditability and traces, trackability and accountability." If anything is going wrong, he suggests, it is at smaller companies still experimenting: for the large enterprises, "the cost of going wrong is too expensive."

The other industry watching this space sees even less. Dynatrace, whose software observes how enterprise applications, increasingly including AI agents, actually behave in production, says it has not observed such an incident among its Indian customers. Arun Balasubramanian, the company's Managing Director for India and SAARC, pushes back on the premise that Indian enterprises are stumbling into agent deployments at all. "Enterprises are going in a very, very controlled deployment phase," he said in an interview, describing large Indian customers, most of them regulated, as keeping "humans in the room" precisely for "auditability and traces, trackability and accountability." If anything is going wrong, he suggests, it is at smaller companies still experimenting: for the large enterprises, "the cost of going wrong is too expensive."

It has already happened, just not here

There is a reason to treat that reassurance carefully, and it is a year old.

In August 2025, attackers obtained OAuth tokens belonging to a single third-party integration, the Drift chat product owned by Salesloft, and used them to reach the connected Salesforce environments of a long list of downstream companies, a number of them security firms. No employee was phished at the victim organisations. No malware was installed on their systems. A machine credential belonging to a piece of software that had been legitimately connected months earlier was enough, and because that credential was doing exactly what it had always been permitted to do, very little about the traffic looked wrong.

That was not an AI agent. It was the simpler ancestor: a static integration token. The agents now proliferating inside Indian enterprises hold the same kind of credential with considerably more autonomy, more reach and less predictability. The precedent for the attack already exists. What has not yet been publicly documented is an Indian version involving an agent.

Absence of incident, absence of proof

Between the vendor that sells protection and the vendor that sells visibility, then, the state of the market is this: the warnings are loud, the mechanisms are young, and nobody will point to a confirmed agent incident on Indian soil. That should be read carefully. It is not evidence of safety.

The data on preparedness is unambiguous. IBM's 2026 breach study found fewer than half of organisations actively secure their non-human identities, even as machine identities at most enterprises already outnumber the humans. The same study found shadow AI, meaning systems deployed without approval, figuring in 43 per cent of security incidents, more than double the year before. The SANS Institute, surveying more than 500 security professionals this year, found roughly three-quarters of organisations reporting growth in non-human identities and a similar proportion already running AI agents or automations that need credentials.

Adoption is not waiting for the protections either. In research Dynatrace published this week, drawn from a survey of 919 senior IT leaders conducted between October 2025 and January 2026, 58 per cent of Asia-Pacific organisations were already using autonomous agents, a higher share than either Europe or the Americas. The credentials are multiplying faster than anyone is counting them, let alone protecting them.

The industry's own spending suggests it knows the gap is real. A fortnight ago Dynatrace, the same company whose India head reports seeing no agent-credential incidents, agreed to pay 915 million dollars for Arize, a firm built to evaluate and trace what AI systems are actually doing. Gartner, meanwhile, placed oversight of agentic AI at the top of its cybersecurity trends for the year, with the adaptation of identity management to AI agents listed separately alongside it. In the United States, NIST opened a public consultation early this year on how organisations should build and deploy agent systems safely.

India's regulators have said nothing. Neither the Reserve Bank of India nor CERT-In has commented publicly on the Bank of Baroda incident, more than a month after the bank confirmed it, and neither has issued guidance on agent credentials.

Thousands of new doors

Bank of Baroda was not an AI incident. No agent was involved; a person's mailbox was enough, and that is the point. The oldest attack there is, a stolen login, remains the front door, and Indian enterprises are now installing thousands of new doors whose keys no one holds, no one rotates, and, on the evidence of two industries paid to watch, no one is yet certain how to guard. TripleX did not even ask the bank for money before publishing; when the product is the damage itself, backups restore the systems and nothing else.

The incidents have not arrived. The credentials have. The gap between those two sentences is where India's next identity problem is already being issued, one service account at a time.