Password Resets Don't Offboard AI: How to Revoke AI Tokens, Agent Configs, and App Connections

In early November 2026, the security firm Apiiro reported that developers' approved commands in Claude Code were being saved in plain text in a settings file. When those files were committed to public GitHub repositories, they exposed passwords, API keys, and SSH logins. Apiiro's broader count reached 2,539 secrets across 1,994 public repositories. The company did not test the credentials, and some of the exposure came from git history and saved transcripts, not only current files.

The same month, other researchers reported that infostealer malware is collecting AI tool tokens. Those tokens can keep working after a password reset. A reset changes the password. It does not end a session, a refresh token, or an API key that already exists.

That is the gap in most offboarding processes. They assume a disabled account means a disabled person. For AI tools, it often does not.

Why Disabling the Identity Account Is Not Enough

Identity providers control whether someone can sign in. They do not always control what has already been issued.

Okta's own documentation shows the limit. In its Privileged Access product, deactivating a workload connection stops new tokens from being issued, but tokens already issued remain valid. Okta also states that individual access tokens cannot be revoked one at a time. For API keys, revocation can take up to five minutes to take effect because the token issuer caches the key.

Okta's AI-agent materials describe the same problem and a remedy. Its Okta for AI Agents blog describes a kill switch that prevents new token requests and future authorizations when an agent behaves unexpectedly. The fact that a kill switch is needed is the evidence. Disabling a person does not automatically stop the agents, tokens, and grants that person created.

Okta's threat intelligence team reached a similar conclusion from the attacker's side. In September 2026 it reported that an infostealer-log dump from August contained unexpired AI-service session tokens. Attackers could replay those tokens to enter accounts without a password or a multi-factor prompt. A password reset does not invalidate them.

The Five Places AI Access Hides

An AI offboarding process has to check five places:

• Session tokens issued to a browser or desktop app, which can survive a password change.

• OAuth grants to productivity suites and business apps, which often stay active until the user revokes them.

• API keys stored in repositories, scripts, CI pipelines, and developer tools.

• Agent configuration files that store approved commands, credentials, or connection details.

• Paid seats and credits attached to the departing person's account.

Each place needs its own step.

A Five-Step AI Offboarding Checklist

1. Find every AI app, OAuth grant, and agent per user. For the departing employee, list the AI tools they signed in to, the third-party apps they authorized, and the agents or automations they created. Use SSO logs, OAuth grant reports from Google Workspace or Microsoft 365, browser signals, and expense data for AI subscriptions. Ask the employee's manager which automations and bots the person set up. Record the system each one touches and the date it was last used.

2. Revoke tokens and grants. Revoke OAuth grants at the app or the identity provider. Revoke active sessions and refresh tokens. Deactivate agent connections so they cannot request new tokens. For each one, record the time of revocation. Then test the result: try the old token against the real service. If it still works, revocation is not complete.

3. Rotate secrets in repositories and configs. Search repositories, git history, CI logs, and shared folders for the employee's keys and for agent configuration files, such as .claude/settings.local.json. Rotate every key found, including keys that appear only in history. Remove the committed files from the repository, and block them with .gitignore and secret scanning. Treat agent folders and memory files as containing secrets, the same way you treat .env files.

4. Remove seats and credits. Compare each AI tool on the list with its license assignments in the vendor's admin console. Remove the seat or credit allocation, then confirm that the charge stops on the next billing cycle. Check whether unused credits return to the pool or stay attached to the departed account.

5. Log it for the audit. Record each item found, the owner, the revocation time, the rotation date, the seat removal, and the test result. Keep the record with the leaver's offboarding ticket. Auditors will ask for it, and an incident responder will need it if a token is later abused.

The India Angle: The Six-Hour Clock

Indian companies have a specific timing constraint. Under CERT-In's 2022 Directions, covered entities must report listed cyber incidents to CERT-In within six hours of noticing them or being told about them. The listed incidents include unauthorized access to IT systems or data, and data leaks.

A leaked AI credential can fall within those categories, depending on what the credential allowed and whether it was used. If a key is found exposed in a public repository, or an employee's token is used from an unknown location, the six-hour period may start before anyone has finished investigating. That is why the offboarding checklist needs a named person who can decide quickly whether an incident is reportable. Involve legal counsel early, because the classification is a legal judgment, not a technical one.

Where OptyStack Fits

OptyStack covers several parts of this workflow, and each one is a separate capability.

Discovery. OptyStack finds SaaS and AI tools using signals from spend, SSO, and browser activity. It shows which AI apps exist, which people sign in to them, and which were adopted outside IT. It flags shadow AI and ranks each finding by risk.

Lifecycle. The Pro plan includes user lifecycle management, so access can be managed when someone joins, moves, or leaves.

Clean-up. The Pro plan also includes unused license reclamation, which helps remove paid seats that remain after an employee leaves.

Access. According to OptyStack's identity management page, OptyStack acts as the identity provider for connected third-party apps and applies IP address, device, and region conditions to sign-ins. These controls cover sign-ins through OptyStack. They do not revoke tokens that developers store in repositories or agent configuration files.

OptyStack does not rotate keys in your repositories, scan git history for secrets, or revoke tokens issued by vendors. Those steps belong to your engineering and security teams, with the vendor's own controls. OptyStack helps with the inventory and the seat clean-up.

Ask OptyStack to show, in a demo, how discovery, lifecycle, and license clean-up work together for one departing employee. If you want to see the AI tools in your environment first, you can start a free trial.