Real estate brokerages are increasingly turning to AI agents—software that can draft follow-ups, update CRM records, chase transaction paperwork, and keep pipelines moving. But according to Chris Skipworth, CEO of Passpack, a zero-knowledge password management company, many brokerage leaders are blurring a critical distinction: an AI agent is not a smarter chatbot. “A chatbot talks. An agent acts,” Skipworth says. “The ability to act is the whole story, and it’s also where the security question starts.” That distinction matters because agents operate inside the systems they are given access to—the CRM, the inbox, the transaction platform, or the shared drive of client documents—in order to send emails, edit records, file documents, or book showings. A chatbot can only discuss those systems; an agent works within them.
Skipworth, who moved into software from the semiconductor industry, has spent his career watching new technology get adopted faster than it gets governed. He sees the same pattern forming here. “People rely very heavily on these tools and don’t ask what they’ve been handed the keys to,” he says. “Once you see an agent as a new kind of user with access to your systems, the right questions follow on their own.” The core problem is that every agent runs on borrowed access. An agent has no access of its own; whatever it can do, it can do because a person or team lent it credentials—a login, an API key, a token, or a connection to a shared account. In a fast-moving brokerage, the quickest way to get an agent working is often to set it up under one licensee’s login or a shared team account. It then inherits everything that account can reach, including client files, financial documents, and communications, rather than a role scoped to its task. “Nobody sees a new user appear,” Skipworth says. “The agent’s access can quietly exceed its job, and nobody ever decided it should.”
For Skipworth, this is where agents become a credential problem, and why he treats credential management as foundational infrastructure rather than an optional extra. He points to two trends that make loosely managed access riskier. First, AI-powered threats increasingly target credentials directly. “A lot of fake AI applications get installed without anyone vetting where they came from,” he says. “Many are designed to harvest credentials and learn how people behave with them. It’s not just grabbing a password. It’s studying the habits around it.” Second, AI is good at the reconnaissance attackers used to do by hand. “One thing AI is very good at is spotting weaknesses in how an organization protects its credentials,” Skipworth says. “If logins live in a shared drive or a spreadsheet, or an agent’s access sits behind a shared password, that’s an easy find for an attacker with AI tools.” His view is that an agent’s access is only as safe as the credentials it runs on. “A password manager isn’t a guarantee, but it’s the first line of defense. It’s the base you build every other control on.”
Skipworth says brokerage leaders don’t need technical expertise to assess an agent’s reach. They need to ask clear questions: Which systems can it touch? Which client files can it see? Which actions can it take—reading, drafting, sending, editing, or deleting? And whether an agent suggests or executes should be a deliberate decision. The approach he recommends is one brokerages already know from onboarding: defined scope, an accountable owner, and a way to revoke access quickly and completely without disrupting anyone else—far easier when the agent has its own credentials than when it shares a person’s or a team’s login. “None of this means avoiding AI,” Skipworth says. “It means applying least privilege, ownership and offboarding to a new kind of user. Security is a wall that has to keep getting higher, and attackers are always looking for the ladder. Don’t hand them one.” As AI agents become routine in brokerage operations, Skipworth’s advice is to skip the question of how impressive the technology is and ask what it has been given the power to do, and who answers for it. That thinking underpins Passpack’s approach for small and mid-sized businesses: strong, zero-knowledge credential security shouldn’t require an enterprise budget or a dedicated IT team. As agents join the workforce, the same principle applies to them.
