- Melanie grabs her pot plant and obligatory FunkoPop, and leaves the company on Friday at 5 pm.
- By Saturday morning, her badge is dead, her laptop is wiped, her accounts are disabled, her access is revoked, and she’s no longer in the lottery syndicate or secret Santa. Textbook offboarding.
- 09:03 Monday, the AI agent she built six months ago logs into production exactly as scheduled. *cue sinister organ music*
Traditional offboarding assumes that when the employee leaves, their authority leaves with them. But AI agents can authenticate through their own service accounts, OAuth grants, tokens, API keys, workload identities, and integrations. Removing the human doesn’t necessarily remove what the human has created.
Welcome to zombie AI (probably not yet an official phrase, so I’m claiming it here before Gartner does): agents that keep operating, or retain access, long after the ownership, business purpose, or authorization that justified them has expired. And trust me, in the future, we’re going to be seeing rather a lot of them.
Zombie AI’s an identity problem, not a sci-fi problem
Gartner predicts that the average Fortune 500 enterprise will have more than 150,000 AI agents by 2028, up from fewer than 15 in 2025, while only 13% of organizations believe they have the right AI-agent governance in place. And that scale is going to seriously change the problem.
We already understand the risk of orphaned accounts. Zombie agents take the same neglected-access problem and add autonomy. An abandoned account waits for somebody to use it. An abandoned agent may already be using itself.
This is why AI security increasingly overlaps with non-human identities and service account security. The credentials may be valid. The API calls may be legitimate. The agent might even be behaving perfectly. The problem is that nobody still has a good reason for it to be doing any of this.
Traditional offboarding doesn't kill the agent
A normal joiner/mover/leaver process follows the human lifecycle. AI agents have lifecycles of their own.
The employee can leave. The employee can change roles. A project can end. An application can be retired. A proof of concept can quietly become production. Ownership can simply dissolve through organizational archaeology.
- Microsoft now explicitly lists orphaned agents with no active owner as a common AI-agent security misconfiguration, warning that they can continue to interact with users or access data without accountable oversight.
- Meanwhile, Verizon's 2026 Data Breach Investigations Report found employee use of unapproved shadow AI tripled from 15% to 45% in a year.
Today’s shadow AI experiment can easily become tomorrow’s forgotten production dependency.
Zombie AI leaves a chain of authority behind
An agent isn't one tidy object marked “AI.”
Its authority may include an OAuth grant, a cloud role, an API token, a service principal, a database permission, a Model Context Protocol (MCP) connection, a scheduled job, or a delegated credential. That means deleting the visible agent may not solve the underlying access sprawl.
We need to understand identity provenance: where permissions came from, who approved them, what business purpose justified them, and whether that justification still exists.
- The National Institute of Standards and Technology (NIST) is already exploring dedicated standards and best practices for AI-agent identification, authorization, auditing, and non-repudiation.
It may not have an official name, but this is no longer an edge case.
Give AI agents a lifecycle before they become zombies
We need to manage agents as identities with owners, purposes, permissions, and expiration conditions:
- Discover: Inventory agents, credentials, tools, and integrations.
- Register: Give every production agent a named owner and documented purpose.
- Authorize: Apply the principle of least privilege and prefer zero standing privileges.
- Operate: Log who invoked the agent, what it accessed, and what it did.
- Review: Reassess access when ownership, models, tools, data sources, or purpose change.
- Transfer: Require somebody to explicitly accept ownership when the original owner moves or leaves.
- Revoke: Quickly remove unnecessary authority through effective deprovisioning.
- Retire: Remove identities, tokens, integrations, secrets, and downstream dependencies while preserving the audit trail.
ISACA's 2026 guidance reaches much the same conclusion: production agents need documented owners, permitted actions, lifecycle position, monitoring requirements, and a plan for eventual retirement and deprovisioning.
No owner should mean no access
The World Economic Forum's 2026 agent-governance work emphasizes authorization across the full deployment lifecycle, including delegation and human accountability.
Basically: No owner, no access.
Good agent access control shouldn't ask only whether an agent can authenticate. It should ask whether it still should.
That means applying AI access controls continuously rather than approving them once and hoping for the best. Continuous identity security becomes particularly important when identities can act autonomously, around the clock, and considerably faster than Trevor from Accounting. Access should survive only as long as the reason for access survives. Zombie AI is ultimately what happens when we forget that rule.
Where to begin?
Zombie agents become dangerous when access outlives ownership, purpose, or need. Trustle helps teams discover and govern access, reduce standing privileges, automate access lifecycles, and keep permissions aligned with current business context.
See what's included in the full-feature Trustle free trial, and start finding the access that should've already died.
