One Laptop, Four Agents, 88 Credentials

Earlier this year we counted the AI agents working inside the enterprise environments Clutch monitors. Working is the important word. We took 90 days of observed activity across tens of live environments, millions of endpoints and every major sector, and counted an agent only if it did something in that window, held credentials, touched systems. An installed binary that never runs tells you nothing.

In the median enterprise the answer came out to 3.6 working agents for every technical employee, which was higher than I expected going in. In 84% of the environments we measured, agents outnumber the technical staff they work alongside. The population grows 29% a month, doubling roughly every ten weeks, so any number you write down today is stale by next quarter.

We published the full findings today, this post is the short version, plus what I think it means.

A Workforce With No Identity Program

Every human in that ratio was interviewed and background-checked, someone provisioned their access on day one, and someone will pull it when they leave. The agents arrived through an install command. Nobody signed off, because there was nothing to sign, and no joiner-mover-leaver process ever ran, because none exists for software a developer installs on a Tuesday afternoon.

A new hire waits days for access to be provisioned. An agent starts with whatever the endpoint already holds, the AWS profile in the home directory, the GitHub token in a config file, and it moves fast: one in fourteen new agents touched a live credential within its first hour of existence.

The entire identity program was built around the smaller of the two populations.

Four Findings

The report goes deep on each of these. The short form:

Agents are credential aggregators. The average agent uses 15 distinct credentials. That's more than the human sitting in front of it will ever touch. Compromise the agent and everything it holds comes with it, all at once.

Agents already operate in production, mostly with the brakes off. 78% of the enterprises we measured had agents touching production-classified resources: databases, cluster control planes, cloud IAM, warehouses full of enterprise data. So much for the assumption that agents keep to dev environments and scratch data. And in 83% of enterprises we caught agents running with every approval prompt disabled, launched with flags like --dangerously-skip-permissions, which means a single prompt-injection payload or model misstep reaches production before any human gets a chance to intervene.

Three-quarters of agent activity bypasses MCP. This is where I'd push back on the industry. MCP is the headline story of agent tooling, and a wave of vendors is racing to ship MCP gateways, but 73% of agent tool use never touches MCP. Agents mostly drive git, gh, aws, psql, and kubectl directly, with credentials configured long before the agent showed up. Govern only the gateway and most of what agents do stays dark.

The growth holds at 29% a month. Measured from behavior across environments rather than from any one product's rollout. Hold that rate and agents reach parity with the entire workforce, everyone, in about six months.

The Machine from the Title

Aggregate numbers get abstract fast, so the report walks through one real machine, a single developer's MacBook, anonymized and otherwise unchanged. Four everyday coding agents were on it: Claude Code, Codex, Gemini CLI, and Cursor. Between them they drove 29 credentialed tools holding 88 distinct credentials across twelve services, reaching production databases, cloud IAM roles, source control, and ten SaaS platforms.

An attacker who lands on that laptop inherits the union of everything those four agents, 29 tools, and 88 credentials can reach. The developer's own access is the least of it. We picked this machine for the report because it was ordinary.

What I'd Do About It

I've heard the prohibition argument. I don't buy it, mostly because we've all watched it lose twice already, with cloud and then with SaaS, and it lost both times for the same reason: the productivity gain was real and adoption was voluntary, so people routed around the ban. A growth rate of 29% a month is the market telling you it has already decided. All a ban gets you is the same behavior minus the visibility.

The order of operations is visibility first, then governance.

Run the census before the planning cycle ends: which agents exist, on which machines, holding which credentials. Treat agent access to production as privileged access, with a policy for what agents may touch, enforced in the agent runtime instead of in a wiki. Then bring agents under the identity lifecycle you already run for humans and service accounts. Provisioning, least privilege, continuous monitoring of how each credential actually gets used, offboarding. Identity teams have been doing every piece of this for years, just for the smaller population.

The data behind the report comes from lineage Clutch already builds in customer environments, connecting each identity to its origin, where it lives, what consumes it, and what it reaches. That's how you get an honest census.

Read the full report, then ask the question we asked. How many agents are working in your environment right now? If the answer is the approved list, you're holding the wrong document.