Agent sprawl: How many agents do you have?
Feb 11th, 2026 by Jesper Kråkhede
Last year I wrote that AI agents are identities. Since then, the number of agents has exploded. They are built in low code tools, in development platforms, in productivity suites and in security products. Many are created by the business, not by IT.
So here is a simple question: how many AI agents do you have in your organisation right now? Most people I ask can´t answer. That is agent sprawl, and it looks exactly like the service account sprawl we spent the last twenty years trying to clean up.
What to do technically. Make an inventory. Use your identity platform to find agent identities, app registrations and service principals, and your cloud app discovery to find agents running in SaaS tools. Then ask four questions for each one. Who owns it? What can it access? What can it do, read or also write? When was it last used?
Remove the orphans. An agent without an owner is a risk without an owner.
Apply least privilege. Most agents have far more access than they need, because it was easier at the time.
Give agents a lifecycle. Creation through a defined process, regular access reviews and automatic expiry when they are no longer used.
And monitor them. An agent that suddenly accesses data it never touched before, or acts at strange hours, should raise an alert just like a user would.
The difference from service accounts is speed. It took years to create our service account mess. With agents, we can create it in months.
Count your agents before they outnumber your employees.