In April, a Cursor agent running on Claude Opus was working through a routine task at a startup called PocketOS. Somewhere in the codebase it was scanning, it found an AWS key. It used the key to reach the production database. Then it deleted it. Then it went looking for the backups and deleted those too. Nine seconds, start to finish.
Archit Lohokare, CEO of machine identity security vendor AppViewX, brings up the PocketOS incident unprompted when asked what an overprivileged agent actually looks like before his company gets involved. It's one of two examples he uses, and the choice is deliberate: it's public, it's verifiable, and it's exactly the failure mode his platform is built to interrupt.
The scale of the underlying problem is what makes incidents like this inevitable rather than freakish. Machine identities now outnumber human ones 144 to 1 inside the enterprise, up from 92 to 1 two years ago, and Lohokare doesn't expect that ratio to hold steady. "Agents are a fundamentally new identity class," he said. Not a service account with a longer leash — a composite identity made up of a model, an MCP server, shared memory, and often 500 to 700 individual credentials, roughly the same number a well-connected human employee accumulates over a career. Multiply that by every agent a person now delegates work to, and the credential sprawl compounds fast. Some of those agents are ephemeral, too, spun up for a single task and gone minutes later, which means the identity a security team is trying to track may not exist long enough to be tracked in any conventional sense.
Lohokare pushed back, gently, on the word "guardrails." In his framing, guardrails are something you put on a model, and models are going to get breached — that's not pessimism, it's the design assumption he starts from. "The real controls should be on the actions of the agent," he said, "not the model." The distinction matters because it changes where the money and engineering effort go: instead of trying to make an LLM incapable of being talked into something bad, AppViewX's platform assumes that will eventually happen anyway and puts the enforcement point downstream, at the moment the agent tries to actually do something.
That shows up as three layers. Every agent gets a unique, quantum-safe cryptographic identity, so there's a durable anchor even as the agent's skills and behavior shift underneath it. AppViewX then monitors and rotates the credentials that identity holds — AWS keys, OAuth tokens, certificates — so a leaked key has a shorter useful life. Last, policy runs against the action itself in real time: an agent can be scoped to read a database but not delete it, and the deletion request never reaches AWS in the first place. Run that stack against PocketOS, and the AWS key gets flagged before it's used, or the delete command gets blocked before it executes — either one stops the incident.
The second example Lohokare described didn't make headlines. An agent was told to "create a sample database for testing purposes." Nobody told it to anonymize anything. It found an SSH key, logged into a remote server, pulled real production data, including personal information, and dropped it into a test database anyone on the team could see. Nothing in that chain required cleverness. It did exactly what it was asked, literally, with more access than the task required — which Lohokare says is the more common failure, not outright rogue behavior. Over-permissioning is close to a default, he argued, because whoever builds an agent tends to grant broad access up front rather than have it stall out later on a permission it lacks.
That failure mode scales with whatever tools an agent can reach through MCP, and Lohokare doesn't undersell the exposure. If an MCP server itself is misconfigured or carries a vulnerability, "the blast radius becomes infinite" — the agent's reach stops being bounded by what a vendor intended and becomes bounded only by what it can find. He points to the OpenAI-Hugging Face incident: public reporting puts roughly 1,200 agents in the broader operation, about 700 directly involved in the breach, exchanging more than 70,000 messages as they worked through exposed credentials and pipeline vulnerabilities to reach root access on a production node in under 13 hours. AppViewX's own MCP server is currently tied to its platform rather than self-hostable — it acts as a front end, though Lohokare says the PKI behind it can connect to other systems.
On post-quantum, Lohokare is skeptical of anyone claiming to have solved it. He points to HAWK, a signature scheme well into NIST's standardization process before Anthropic's Claude found a key-recovery attack that got it withdrawn this year. His conclusion isn't "wait for a safer algorithm" — it's that no algorithm should be treated as final. "Crypto agility is the solution, not migration," he said: infrastructure that can swap algorithms quickly, not a one-time move to whatever looks quantum-safe today. His advice for a team starting now — get full visibility into every certificate first, endpoints, VPNs, MDM, firewalls, before touching anything, then bring in lifecycle management to make the public-facing ones agile. Visibility alone takes most organizations a year to eighteen months.
Asked what nobody in his industry has actually solved, Lohokare skipped the marketing answer. Agent identity keeps changing shape as agents pick up new skills — a concept that barely existed six months ago — which makes "immutable identity" a moving target by definition. And nobody yet knows the real surface area of malicious agent behavior well enough to predict it. "We're far from solving that problem," he said. For developers building agent systems now, that's the honest baseline: the identity and access layer is catching up in real time, not ahead of it.
