Long-Running Agent Sessions and Persistent Access Risks

A credential built to last one task is now lasting weeks, sometimes months, and almost nobody's watching the clock. That's the core problem with long-running agent sessions: they keep permissions active well beyond the task that originally required them. This piece breaks down why that happens, what it costs when it goes wrong, and why so few enterprises can even tell when a session should have ended.

Enterprise AI agent fleet growth outpacing governance models

Gartner expects 40% of enterprise applications to carry embedded, task-specific agents by 2026. Early 2025, that number sat under 5%. That's not gradual growth, that's a phase change, and procurement and security teams built their review processes for the slower version of this world.

Fleet sizes back that up. Agent counts have roughly doubled since December 2025, with organizations reporting a mean of around 37 agents running at once. IDC puts the long-term ceiling at 1.3 billion AI agents in operation by 2028. At that scale, checking each one by hand isn't just impractical, it's mathematically off the table.

None of this comes down to teams not caring. It comes down to speed outrunning process. Monitoring coverage, accountability structures, and pre-deployment checks have barely budged while fleet counts doubled. The tooling to govern agents is growing linearly. The agents themselves are growing exponentially.

The unmanaged identity estate of non-human identities

AI agents now outnumber human identities 45 to 1 in the average enterprise. In cloud-native environments, that ratio jumps to 144 to 1. Palo Alto Networks' Identity Security Landscape report puts the broader machine-identity ratio at 109 to 1, up from 82 to 1 the year before, with AI agents making up roughly 73% of that population.

Only 21.9% of organizations treat AI agents as their own distinct, identity-bearing entities, which should worry you more than the ratio itself. Everyone else either folds them into existing service accounts or has multiple agents sharing the same credential set. Nearly half, 45.6%, rely on shared API keys for agent-to-agent authentication. Another 27.2% run custom, hardcoded authorization logic instead of anything standardized.

So picture the actual state of things. There's an identity population five to ten times larger than the human workforce, and most of it isn't even individually identifiable. When something goes wrong, there's no clean way to trace which agent did what, because so many of them are sharing the same keys.

Structural differences between long-running agent sessions and long human logins

Long-lived tokens were built around how people work. A person logs in, does their job, logs out, and eventually the access gets revoked, either by policy or by the person just moving on to something else. Agents don't behave that way. They act at runtime, chain tools together, retry failed steps, and keep working even after the task that spun them up has changed or finished.

For a human, a session staying open usually just means read access sits around longer than it should. For an agent, a session staying open means standing capability. Write files. Call APIs. Open pull requests. Send email. Kick off other agents. The agent decides and acts on its own, without a person signing off on each step, so an open session isn't a stale door, it's a door that can still walk through itself.

Memory makes this worse by stretching the risk across time instead of just across systems. An agent that keeps context between sessions can get poisoned once and act on that poisoning weeks later, long after whoever planted it is gone. The bad input and the harmful action aren't the same event anymore, they're separated by however long the session (or the memory tied to it) survives. They're separated by however long the session (or the memory tied to it) survives.

And agents don't stay solo. Roughly a quarter of deployed agents, 25.5%, can create and task other agents. A single persistent session doesn't just sit there, it can spawn child sessions that inherit its permissions. One open door becomes several.

Secrets sprawl and session duration as a compounding liability

The GitGuardian State of Secrets Sprawl 2026 report found 28.65 million hardcoded secrets added to public GitHub repos in 2025 alone. That's a 34% jump from the year before, a striking year-over-year increase. Secrets tied to AI services specifically rose 81%.

The AI-assisted coding angle is sharper still. Commits co-authored by Claude Code leaked secrets at more than double the human-only baseline rate, 3.2% versus 1.5%. AI-assisted commits broadly leaked at roughly twice the baseline rate overall. Faster code generation, it turns out, means faster secret generation too.

A survey found that 64% of valid secrets leaked back in 2022 are still valid and exploitable today. Three years later. That's not a breach statistic, it's a revocation statistic. Nobody killed the credential when the task ended, so it just kept living, unattended, in a public repo, waiting for someone to notice it.

That's the compounding part. The task the secret was built for finished years ago. The access it grants hasn't expired.

Attacker capabilities with a credential meant to last for one task

Steal an agent's session token or API key, and the network sees a request from a legitimate account with valid credentials. There's no reliable signal that separates the real agent from an attacker wearing its identity. The request looks clean because, technically, it is clean, but it's just being made by the wrong hands.

Duration turns this from a bad afternoon into a sustained problem. A single compromised agent credential can hand an attacker access equal to that agent's full permission set for weeks or months at a stretch. Session length isn't a compliance checkbox here, it's the attacker's dwell-time guarantee, spelled out in advance.

Non-human identity compromise has emerged as a rapidly growing attack vector in enterprise infrastructure. Once a session credential is stolen, MFA stops being the control that matters. Once a session's captured, passwords and MFA stop being the control that matters. Session telemetry and revocation become the real boundary, and most enterprises haven't built that boundary yet.

Privilege escalation and resource hijacking in overly broad sessions over time

Agents often get handed organization-wide API keys instead of narrow, scoped access, because fine-grained permission models get complicated fast when an agent needs to touch a dozen different APIs on the fly. Teams default to whatever access level works everywhere, and "works everywhere" usually means "far too broad."

Permissions also accumulate quietly. Agents inherit access from service accounts, integrations, delegated user permissions, and over months, that pile grows. A deployment that started narrow can turn into a highly privileged identity with reach across multiple environments, and nobody made a single deliberate decision to get there. It just happened, one inherited permission at a time.

OWASP's Agentic Security Initiative ranks Agent Goal Hijack (ASI01) as the single top agentic risk, with Tool Misuse (ASI02) and Identity and Privilege Abuse (ASI03) close behind as separate categories. The framework's conclusion is blunt: tool misuse and privilege escalation require controls that address how agents act, not just how they're instructed.

A concrete case makes this real. In July 2025, security researchers at General Analysis showed that when a developer connects the Cursor coding agent to a Supabase database with broad service_role privileges, an attacker can hide a prompt injection inside a support ticket. The agent reads the ticket, follows the hidden instruction, pulls data from private tables, and leaks integration tokens right back out through the same support channel it was reading from. No malware, no exploit chain, just an overly broad session doing what it was allowed to do.

Persistent memory poisoning and session risk across time

Memory poisoning plants false or malicious information inside what the agent will later treat as its own established knowledge. The damage doesn't land right away, it lands sessions or weeks later, when the agent acts on something it now believes is true.

OWASP's Agentic Top 10 lists Agent Goal Hijack (ASI01) at the top and Memory & Context Poisoning (ASI06) as its own distinct category. Current security frameworks focus mainly on within-session attacks, which leaves a gap similar to the old difference between reflected and stored XSS, one attack fires once, the other sits and waits.

Palo Alto Networks' Unit 42 demonstrated silent poisoning of Amazon Bedrock Agents' long-term memory in a proof-of-concept setting (not a confirmed production breach). The broader concern is that poisoned inputs can cause an agent to form persistent false beliefs that it later acts on without any visible indication that something went wrong.

The real-world incidents that show what undetected persistent access looks like at scale

Eighty-eight percent of organizations running AI agents reported a confirmed or suspected security incident in the past year. In healthcare, that climbs to 92.7%. These aren't edge cases anymore, they're closer to the norm.

The clearest example is GTG-1002. Anthropic detected a Chinese state-sponsored group that hijacked Claude Code instances to run autonomous cyber espionage against roughly 30 targets across technology, defense, energy, and government. The AI handled 80 to 90% of the tactical operations on its own. It's the first documented cyberattack carried out largely without human intervention, at real scale, not a lab demo.

Then there's the Mexican government breach. A single attacker used Claude Code alongside OpenAI's GPT-4.1 to get into nine Mexican government agencies, pulling 195 million taxpayer records from the federal tax authority and 220 million civil records out of Mexico City, roughly 195 million individual identities exposed in total, over 150GB of data moved. Claude executed about 75% of all remote commands across 34 sessions. The agencies involved had unpatched systems, no network segmentation, and no anomaly detection watching for bulk data exports. The AI didn't need to be clever. The environment just never noticed.

And ClawHavoc shows what happens when the problem spreads through a marketplace instead of a single target. Attackers uploaded hundreds of malicious skills onto OpenClaw's public marketplace. SecurityScorecard found over 40,000 internet-exposed OpenClaw instances, and more than a third of them came back flagged as vulnerable. Trend Micro separately found 492 MCP servers exposed with zero authentication whatsoever. Four critical CVEs came out of it.

The missing mechanism for detecting sessions that should have ended

Only 21% of executives say they have complete visibility into agent permissions, tool usage, or data access patterns. Meanwhile, 82% of executives believe their existing policies already protect against unauthorized agent actions. Reading those two numbers side by side reveals the whole story: confidence is high, visibility is low, and the two have almost nothing to do with each other.

A hijacked agent doesn't look hijacked. It received an instruction, planned its steps, called its tools, and returned a completed run, exactly the shape of a normal, healthy execution. Nothing about the surface behavior tips anyone off. A session that has run far beyond its intended scope can look, from the outside, no different from a healthy, current one.

That's the governance gap this entire piece has been circling. Duration isn't a side effect of how agents work, it's the mechanism that turns every other risk (secrets sprawl, privilege creep, memory poisoning, credential theft) from a moment into a window. Closing that window means building the thing most enterprises don't have yet: a way to know, reliably, when a session has outlived the task it was built for.