Why is it risky to share passwords with AI agents?

Shared credentials stay active indefinitely, cannot be separately audited from human activity, and expose every connected system if compromised. A 2026 survey found 28% of businesses using unapproved AI tools were sharing banking and payment credentials with agents.

What is the safest way to give an AI agent access to business systems?

Use scoped API keys rather than shared passwords, limit access to the specific actions the agent needs, and use session-limited authorisation so access expires when the task is complete. Tools like 1Password now integrate directly with AI agents to implement this pattern.

What is prompt injection and why does it matter for business AI agents?

Prompt injection is when a crafted input - for example, a malicious email the agent reads - attempts to redirect the agent into taking unintended actions. Unlike a human, an agent does not intuitively recognise when it is being manipulated, which makes scoped access and human approval checkpoints important safeguards.

Does UK GDPR apply to how AI agents access customer data?

Yes. You remain accountable for how personal data in your systems is accessed and processed, whether by a human or an agent. Scoped access - limiting the agent to only the data needed for the specific task - satisfies the data minimisation principle and is easier to document in a DPIA.

How to Give AI Agents Safe Access to Your Business Tools Without Sharing Passwords

For an AI agent to update a CRM, send an email, or log an invoice, it needs access to those systems. For most small businesses in 2026, that access is still managed the way contractor access has always been managed: share the login and trust the user. That approach breaks badly with software agents. A credential shared with an agent stays active indefinitely, cannot be easily audited, and exposes every connected system if anything goes wrong.

What the current picture looks like

A 2026 survey of UK organisations found that over 20% of those using unapproved AI tools were sharing full login credentials with agents, and 28% were sharing banking and payment information. Okta's AI Agents at Work 2026 report found that 54% of organisations already have unsanctioned or shadow AI agents in use - tools deployed without IT or security sign-off.

For a small business, this risk is concentrated. One shared credential often grants access to your CRM, accounting software, and email in the same account.

Why shared credentials cause problems with agents specifically

Human users have context and judgement. They recognise when an action looks wrong and stop. An agent executes the instruction it receives. If that instruction is malformed, out of scope, or the result of a crafted message designed to misdirect the agent (a technique known as prompt injection), the agent acts on it.

Shared credentials also create an audit problem. If your CRM shows 200 records were updated on Tuesday afternoon, did a human do it or the agent? With shared access, there is no clean way to separate the two.

The three controls that matter

1. API keys instead of passwords. Most CRMs, accounting tools, and email platforms offer API keys that can be scoped to specific actions: read-only access to invoices, send access to email, but not admin rights to either system. Use API keys wherever the tool offers them.

2. Session-limited authorisation. The emerging best practice is for agents to access credentials only for the duration of a specific session, then lose that access when the session ends. On 19 July 2026, 1Password and Anthropic announced a direct integration for Claude that implements exactly this pattern: the agent uses approved credentials without ever receiving the actual password, and access expires when the session closes. Neither the model nor the provider retains the credential.

3. Defined scope per workflow. Document what each agent can and cannot access. An invoice-chasing agent needs read access to your accounting software and send access to email. It does not need access to payroll, HR records, or payment authorisation settings. Least privilege - granting only the access needed for the specific task - is the principle. A written scope list is the practical implementation.

How this connects to UK GDPR

Under UK GDPR, you are accountable for how personal data in your systems is accessed and processed, regardless of whether a human or software does the accessing. Scoped, session-limited access to only the data needed for a specific task is the data minimisation principle applied to agent access. It is also far easier to document in a Data Protection Impact Assessment than a blanket shared login.

The right model is to treat each agent as a new member of staff with a defined role: access to the systems they need, for the tasks they perform, reviewed and revocable if their function changes. That is the same governance standard you would apply to any employee - and it is the right standard for software that acts on your behalf.