Ping Identity puts a leash on personal AI agents

Somebody on your team installed a coding agent last month. It has your git credentials, your cloud CLI session, and whatever else your laptop can reach. Nobody approved it, nobody logged it, and if it deletes a production bucket at 2am the audit trail says it was that person. Ping Identity just shipped a product for exactly this gap, and the fact that personal AI agents now need their own identity layer is the real story.

What actually happened

On September 1, Ping Identity announced Enterprise Personal Agent Access, delivered through PingOne Privilege. It does three things. It discovers personal agents running in the environment, including shadow AI nobody registered. It binds each agent session to the specific user and device behind it. And it governs what the agent can touch at runtime — allow, deny, log, require approval, or revoke, evaluated at the moment of action rather than at install time.

Named support includes desktop assistants such as Claude and coding agents such as Claude Code. Credentials stay out of the agent's hands; Ping calls this secretless privileged access. Agent activity is attributed separately from the human's own activity, which is the part most homegrown setups get wrong. The product is available now and in pilot with enterprise customers.

Ping cites a Gravitee survey of 750 senior technology leaders in the UK and US, run in April 2026, that found 48% of production AI agents running unsecured. The same survey put the share of organizations that fully secure agents before production at under 20%, and the share that assigned formal accountability for agent behavior at roughly 7%. Vendor-commissioned research, so weight it accordingly — but the direction matches what we see in client environments.

Why personal AI agents matter for your business

You do not need Ping's price tag to fix the biggest hole. The default failure is that an agent runs as the user, with the user's full standing permissions, and every action it takes lands in the logs under a human name. That destroys attribution and makes least privilege meaningless.

Three moves, in order. First, inventory: ask what agents are running on team machines and in CI. Second, give agents their own credentials — a separate service identity per agent, scoped to the resources that agent actually needs, never the developer's personal token. Third, make the destructive operations ask. Most agent harnesses support an approval gate on writes, deletes, and deploys; turn it on before you find out the hard way why it exists.

The vendors are building this because the primitive was missing. You can build a smaller version yourself in an afternoon.

Sources: Ping Identity press release, Help Net Security, Gravitee State of AI Agent Security.