Real estate brokerages are increasingly being sold on AI agents—software that drafts follow-ups, updates the CRM, chases transaction paperwork, and keeps a pipeline moving. But much of that conversation blurs a distinction that Chris Skipworth, CEO of Passpack, thinks brokerage leaders cannot afford to miss. An AI agent is not a smarter chatbot. "A chatbot talks. An agent acts," Skipworth says. "The ability to act is the whole story, and it's also where the security question starts."
The difference matters because agents operate inside systems. To send an email, edit a record, file a document, or book a showing, an agent needs access to the CRM, the inbox, the transaction platform, or the shared drive of client documents. A chatbot can only discuss those systems; an agent works within them. Skipworth, who moved into software from the semiconductor industry and now leads a zero-knowledge password management company for small and mid-sized businesses, has spent his career watching new technology get adopted faster than it gets governed. He sees the same pattern forming here. "People rely very heavily on these tools and don't ask what they've been handed the keys to," he says. "Once you see an agent as a new kind of user with access to your systems, the right questions follow on their own."
Every agent runs on borrowed access. An agent has no access of its own. Whatever it can do, it can do because a person or team lent it credentials: a login, an API key, a token, a connection to a shared account. In a brokerage, where teams move fast and share tools, the quickest way to get an agent working is often to set it up under one licensee's login or a shared team account. It then inherits everything that account can reach, including client files, financial documents, and communications, rather than a role scoped to its task. "Nobody sees a new user appear," Skipworth says. "The agent's access can quietly exceed its job, and nobody ever decided it should."
For Skipworth, this is where agents become a credential problem, and why he treats credential management as foundational infrastructure rather than an optional extra. He points to two trends that make loosely managed access riskier. The first is that AI-powered threats increasingly target credentials directly. "A lot of fake AI applications get installed without anyone vetting where they came from," he says. "Many are designed to harvest credentials and learn how people behave with them. It's not just grabbing a password. It's studying the habits around it." The second is that AI is good at the reconnaissance attackers used to do by hand. "One thing AI is very good at is spotting weaknesses in how an organization protects its credentials," Skipworth says. "If logins live in a shared drive or a spreadsheet, or an agent's access sits behind a shared password, that's an easy find for an attacker with AI tools." His view is that an agent's access is only as safe as the credentials it runs on. "A password manager isn't a guarantee, but it's the first line of defense. It's the base you build every other control on."
Skipworth says brokerage leaders don't need technical expertise to assess an agent's reach. They need to ask clear questions: Which systems can it touch? Which client files can it see? Which actions can it take? Reading, drafting, sending, editing, and deleting carry very different risks, and whether an agent suggests or executes should be a deliberate decision. The approach he recommends is one brokerages already know from onboarding: defined scope, an accountable owner, and a way to revoke access quickly and completely without disrupting anyone else—far easier when the agent has its own credentials than when it shares a person's or a team's login. "None of this means avoiding AI," Skipworth says. "It means applying least privilege, ownership, and offboarding to a new kind of user. Security is a wall that has to keep getting higher, and attackers are always looking for the ladder. Don't hand them one."
The implication for brokerage leaders is direct: as AI agents become routine, the question is not how impressive the technology is but what it has been given the power to do, and who answers for it. That thinking underpins Passpack's approach for small and mid-sized businesses: strong, zero-knowledge credential security should not require an enterprise budget or a dedicated IT team. As agents join the workforce, the same principle applies to them.
