Option: do nothing — a broad credential, and hope
This is what almost everybody is actually doing, so it gets a proper assessment rather than a sneer. It is also the only "option" that works for rented agents today with zero setup — which is exactly why it is the incumbent, and exactly what the thesis says needs saying out loud.
This baseline is the best-evidenced option on the site: the over-scope, the exploitation, and the missing scoped-token capability are all documented. Date verified: 18 August 2026. Re-run method: check the token scopes your own agent platform actually issues, today, against what your agents' tasks require.
Against the scenario
| Column | Assessment |
|---|---|
| Steps to working | One: paste the credential. That is the whole appeal, and the honest reason this baseline wins by default. |
| Prerequisites | None. |
| Privileges granted | The failing column. Each agent holds a broad, long-lived credential; four agents each holding a vault secret in plain configuration can typically read each other's, violating the scenario's "nobody can use another's access" outright. The documented real-world case: one assistant's token was scoped to every repository its developer had authorised. The blast radius is the transitive closure of everything each credential reaches — not what you meant to grant. |
| Setup cost | Zero — which is where the cost hides: it is all deferred into incident cost, at closure scale. |
| Cost per identity per month | Zero, monetarily. Each added identity widens the union of reachable systems. |
| Cost per use | Zero. |
| Runs where | Anywhere — the only option with no infrastructure requirement at all. |
| Works for rented agents | Yes — the only current option that does, which is the thesis in one table cell. |
| Date verified | 18 August 2026 |
If you run this baseline anyway — and you probably do
The hope ladder applies directly: enumerate the credentials, map their closures, put spend and time ceilings on every agent, log independently, and move whatever work can be moved to workflows that need no credential at all — the serialised pull request being the sharpest example. None of that gives a rented agent an identity. All of it shrinks what hope has to cover for.
Sources
- The token scoped to every authorised repository; agents use far more permission than a human would: venturebeat.com
- An unprivileged issue reaching CI secrets in three vendors' own repositories (Black Hat, 5 Aug 2026): cloudsecurityalliance.org
- The open feature request for short-lived repository-scoped agent tokens: github.com
- In each studied incident, the agent held credentials it did not need: cequence.ai