IBM makes Agent Identity and HashiCorp Vault 2.2 generally available to govern AI agents
At TechXchange 2026 on October 27, IBM made Agent Identity and HashiCorp Vault 2.2 generally available. Agent Identity records each AI agent's owner, lifecycle and granted authority, while Vault gives agents their own accounts, renews their credentials and revokes them on unauthorized actions.
IBM announced identity and control features for enterprise AI agents at its TechXchange 2026 conference in Atlanta on October 27. Two are generally available now. IBM Agent Identity "establishes the authoritative record for each agent," covering its owner, lifecycle status and granted authority. HashiCorp Vault 2.2 gives agents their own secured accounts, renews their credentials automatically and adds post-quantum encryption, and IBM says Vault enables "real-time revocation when an agent attempts an unauthorized action." IBM also made watsonx Orchestrate evaluation features generally available, while Discover, which finds agents built on Amazon Bedrock, Microsoft Foundry and Google Gemini, and Contain, which sandboxes agents and adds a kill switch, are in tech preview. Secure Hub, for visibility across Vault environments, is in public preview. IBM cited Gartner figures that only 13% of organizations believe they have the right AI agent governance in place.
Why it matters
The announcement splits agent identity into two records: who the agent is and who answers for it, and what short-lived credential it holds right now. It is the same split Infisical is funding with its credential broker. An agent running on a developer's long-lived API key has neither: no named owner and no expiry.
Whatever platform you use, give every agent an accountable human owner, issue it scoped credentials that expire, and make revocation a tested path, not a ticket. At TechXchange, Albert Einstein College of Medicine is presenting its use of IBM Verify and Vault for agent identity. Our guide to securing AI agent identities covers the controls, and the Agent Identity Standards Map 2026 maps the open standards for agent authentication and delegation.
Source: IBM Newsroom
Related on Start with Identity
- BlogPoisoned LiteLLM 1.107.0 shipped a credential stealer to PyPI and Docker for under three hours
LiteLLM said on October 21 that attackers published a malicious litellm 1.107.0 to PyPI, Docker Hub and GHCR, built from a lookalike Berri-AI/litellm repository
- BlogLiteLLM traces its poisoned release to an admin key leaked in May and never revoked
LiteLLM's October 23 attack-chain report says an Agent Platform admin key committed to a public repo on May 27 was deleted but never revoked. On October 10 it r
- BlogMicrosoft names Storm-0940 behind ConnectWise app abuse that reached 2,250 Microsoft 365 tenants
Microsoft said on October 21 that China-aligned Storm-0940 used the ARTEX agentic AI framework and stolen ConnectWise application identities to try signing in t
- ReportIdentity Breach Report 2026: how attackers get in
115 identity breaches, 2021 to 2026: MFA was bypassed in 25 of the 40 with a known MFA status, and 46.5% of 2025-2026 cases had no login for MFA to protect.
- Comparisonakeyless-vs-hashicorp-vault
Akeyless and HashiCorp Vault both deliver enterprise secrets management, dynamic secrets, and certificate and key services, but they differ on operating model.
- Comparisonaws-secrets-manager-vs-hashicorp-vault
This is the classic build-on-the-cloud versus run-a-platform decision. AWS Secrets Manager is a fully managed service that stores and rotates secrets with deep,