Always-on AI coworkers outgrow agent security, vendor argues

Identity security firm Token Security argues that a new class of "persistent AI coworkers" breaks the security assumptions built for earlier AI agents, in an article published on BleepingComputer on 30 September 2026.

The company's central claim is about how these systems run. Unlike agents that are invoked for a single task and then stop, Token Security says persistent AI coworkers may operate continuously and hold standing access, meaning permissions that stay switched on rather than being granted for one job and then withdrawn. According to the company, that combination creates identity risks that existing security models were not designed to handle.

The fixes Token Security proposes are all drawn from conventional identity management. It says these agents need their own identities, rather than borrowing the credentials of a human user or sharing a generic service account. It says each one needs an owner, so that a named person or team is accountable for what the agent can reach. It says permissions should be scoped, limiting each agent to the systems and data it actually needs. And it says agents need lifecycle controls, so that access is provisioned when an agent is created and removed when it is retired or changes role.

The framing in the piece is that this is AI's "third wave" of workplace deployment, following earlier patterns of AI use that the company says the old security model could cope with. Token Security's argument is that continuous operation is the difference that matters. An agent that only exists for the duration of a task leaves a small window for misuse. An agent that never stops, and whose access never lapses, looks more like a standing account inside the organisation.

Readers should note the nature of the source. The article is an explainer from a vendor that sells identity security for non-human accounts, so the problem statement and the recommended controls point in the same commercial direction. The piece as published does not present incident data, named victims or measured failure rates, and no specific product vulnerability is disclosed.

Even so, the practical questions it raises are the ones security teams can act on without buying anything. Does every AI agent running in your environment have an identity that can be distinguished from a human's? Can you name the person responsible for each one? Do you know what each agent is permitted to touch, and when that permission was last reviewed? And is there a process that turns an agent's access off when the agent is decommissioned, or does it simply keep working?

Token Security's position is that organisations deploying always-on agents should answer those questions before scale makes them harder. The company said these agents require their own identities, owners, scoped permissions and lifecycle controls, and framed the absence of those controls as the gap left by security models built for short-lived automation.