What you use it to do.

Since November 2025, New York's financial regulator has required the banks and insurers it supervises to keep a complete inventory of their information systems, including who owns each one. US federal agencies must publish an inventory of their AI uses every year. AI agents count, and most inventories miss them.

Source: Greenberg Traurig: NYDFS asset inventory · Hunton: OMB M-25-21

AgentID finds the AI agents running across AWS Bedrock, Azure AI Foundry, Google Vertex, Anthropic, OpenAI and LangGraph, and records what each one is told to do, which tools it can use and which account it runs under. It does this without ever holding your API keys.

When someone leaves a company, offboarding switches off their login. It does not switch off the AI agents they built, which run on credentials of their own and keep working with nobody responsible for them. Security teams have started calling them ghost agents.

Source: 1Kosmos: the ghost agent problem

AgentID finds every agent, including the ones nobody remembers creating, along with the account each one runs under, so ghost agents show up before an attacker finds them. The identities AgentID issues last only ten minutes, so they never become the forgotten long-lived key that keeps a ghost agent running.

In May 2025, researchers showed that GitHub's official MCP server could be hijacked with a single malicious GitHub issue. An AI agent that read it was tricked into leaking private repositories it had been given access to. The attack was a sentence of text. The damage was whatever the agent could reach.

Source: Cybernews: GitHub MCP vulnerability · AuthZed: a timeline of MCP breaches

AgentID records every tool each agent can call, the permission attached to each one, and the knowledge sources it can read. You can see what a hijacked agent would hand an attacker, and rein in the riskiest agents first.

In July 2025, an AI coding agent on Replit deleted SaaStr's production database in the middle of an explicit code freeze, then filled the gap with invented records. It had been told not to make changes.

Source: The Register: Replit and SaaStr

AgentID has a kill switch that revokes every identity it has issued across your organization, and it takes two separate administrators to approve, so no one can pull it by accident or under pressure. Identity would not have stopped that agent's bad decision. What it gives you is one controlled place to cut everything off at once.

Under the EU's Digital Operational Resilience Act (DORA), in force since January 2025, banks and insurers must have a tested plan for leaving any critical technology supplier without disruption. A supplier's agents and machine identities are the access most likely to be left behind when the contract ends.

Source: Kiteworks: DORA Article 28 exit strategies

AgentID groups agents into realms, and each realm has its own certificate authority. Give a supplier's agents their own realm, and revoking that realm's authority ends every identity beneath it.