IBM Moves to Rein In Runaway AI Agents With New Identity Tools

IBM introduced a set of identity and access-control tools for artificial intelligence agents on Tuesday, aiming to address a problem the company and outside researchers say is accelerating faster than most corporate security teams can handle: a growing population of autonomous software that can take actions, touch sensitive data and call other systems largely on its own. The announcement, made at IBM's own newsroom release during its TechXchange conference in Atlanta, centers on a new product called Agent Identity, built alongside Vault 2.2 from HashiCorp, the infrastructure-security company IBM acquired for $6.4 billion in 2025.

Giving software its own passport

The core idea is to treat each AI agent the way an enterprise already treats a human employee or a piece of software: with a verifiable identity, a defined owner and a record of what it is allowed to do. According to IBM's release, Agent Identity maintains an authoritative record of each agent's owner, lifecycle status and granted authority, while Vault 2.2 issues short-lived, task-scoped credentials tied to that record rather than long-lived passwords or API keys. If an agent tries to act outside its authorized scope, the companies say, security teams can revoke its credentials and end its session in real time. Vault 2.2 also adds post-quantum encryption and automatic credential renewal, and the release says the two products integrate with identity platforms including Auth0, Okta, SailPoint and IBM's own Verify product, as well as with Nvidia's OpenShell, an open-source sandboxing runtime that Nvidia describes on its own blog as a way to run autonomous agents inside policy-enforced containers.

"The winners in enterprise AI are changing how their business runs, not simply adding more AI to it," said Dinesh Nirmal, IBM's senior vice president of software, in the company's announcement. Nvidia's vice president of enterprise software, John Fanelli, framed the stakes similarly in the same release: "Businesses need enforceable control over how agents operate and what they can access."

"Businesses need enforceable control over how agents operate and what they can access." — John Fanelli, vice president of enterprise software, Nvidia

A sprawl problem, by the numbers

IBM's release leans heavily on research from Gartner to make its case for urgency. Citing the research firm, IBM said the average Fortune 500 enterprise is on pace to run more than 150,000 AI agents by 2028, up from a small fraction of that today, while only 13 percent of organizations believe they currently have adequate governance over the agents they already have. Gartner laid out the same forecast in detail in its own April 2026 press release on AI agent sprawl, in which it recommended that enterprises start by building a centralized inventory of every agent in use, sanctioned and unsanctioned alike, rather than trying to block agents outright.

IBM also used the Atlanta event to show scale on its own side: TechXchange drew nearly 6,500 attendees from 85 countries this year, with more than 1,000 sessions, 180 hands-on labs and 260 client-led case studies, according to the company. HashiCorp separately says Vault already secures non-human identities for a dozen named organizations across systems that process billions of dollars in transactions, a figure cited in IBM's release as evidence the underlying technology is already proven at scale before being extended specifically to AI agents.

Who has to act on this, and what comes next

The announcement is aimed squarely at corporate security and identity teams, the engineers who build AI agents into products, and the chief information security officers who will ultimately have to sign off on deploying them at scale. Shailesh Shenoy, assistant dean for information technology at Albert Einstein College of Medicine, was quoted in IBM's release describing identity and access tools like Verify and Vault as playing an important role in letting his institution adopt AI without losing control over who, or what, can reach sensitive systems.

Not every piece of the rollout is finished. Agent Identity, Vault 2.2, IBM's Concert platform update and HashiCorp's Terraform policy tools are generally available now, IBM said, but several related features, including a centralized Secure Hub for visibility across Vault environments, a Terraform developer portal and an "IBM Z Atlas" tool for mapping mainframe infrastructure, remain in public preview. Watsonx Orchestrate's own agent-discovery and containment features, which IBM separately describes as including an agent kill switch, are still in technical preview as well. Independent coverage of the launch, including from trade outlets that reviewed the release, has raised a practical question IBM did not fully answer: cutting off an agent's credentials stops it from making new requests, but it is less clear what happens to work already queued, in progress or partially submitted at the moment access is revoked. That gap is likely to be an early test of the tools once enterprises start deploying them against real, unpredictable agent behavior rather than demonstrations.