AI agents reuse service accounts. Find the ones that open the domain.
Many agents do not get an identity of their own. They run on an existing service account, cloud role or API key, and inherit everything that identity could already do. The agent is new. The access is years old.
Why service accounts decide the impact
In the PaperCut campaign, hundreds of AI agents exploited print servers at 395 organisations. Where the software ran as a domain-admin service account, the attacker needed no further exploit to take the domain. In the retail campaign Gambit reconstructed, one database identity could read card data, create tables and drop backups. The exploit opened the door. The service account decided how far the attacker got.
What Elmoz shows for service accounts and roles
Five questions Elmoz answers for every service account, role and key an agent runs on.
Including identities shared by several agents or services.
Roles, group memberships and data stores, traced as paths.
Service accounts whose owners have left are flagged.
Keys that have not rotated in months and where they are stored.
Scope a role, split a shared identity or rotate a key, with the impact shown first.
The smallest safe change. Impact shown first.
Scope a role, split a shared identity or rotate a key, with the impact shown first.
An example path
The agent is new. The access is years old. Three agents share one service account whose role can delete the production backups. Elmoz shows the shared identity and the reach in one view.
Questions, answered.
Short answers on agents that run on existing service accounts and roles.
Do AI agents need their own identity?
They should have one. When an agent reuses an existing service account or key, it inherits all of that identity's access and its actions cannot be told apart from the original service.
How do I find over-privileged service accounts?
Trace what each service account can reach, not only which roles it has. Look first at identities that reach production data, domain admin groups or backups, and at identities without a current owner.
What is a shared identity risk?
When several agents or services use one identity, compromising any of them gives the attacker the combined access. Splitting the identity limits the blast radius.
More ways in.
Every use case ends in the same place: a path from an identity to sensitive data.
Coding agentsWhat Cursor, Claude Code and Codex can reach through the credentials around them.Coding agents →MCP serversThe credentials behind every tool, and the data at the end of them.MCP servers →OAuth appsEvery grant to an AI tool, its scopes and where a vendor breach would lead.OAuth apps →The platformDiscover, trace, prioritize and fix, in one security graph.Platform overview →See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.