Real estate brokerages are being sold on AI agents: software that drafts follow-ups, updates the CRM, chases transaction paperwork and keeps a pipeline moving. But much of that conversation blurs a distinction that Chris Skipworth, CEO of Passpack, thinks brokerage leaders cannot afford to miss. An AI agent is not a smarter chatbot. "A chatbot talks. An agent acts," Skipworth says. "The ability to act is the whole story, and it's also where the security question starts."
The distinction matters because of what an agent needs to function. To send the email, edit the record, file the document or book the showing, an agent requires access to the CRM, the inbox, the transaction platform or the shared drive of client documents. A chatbot can only discuss those systems. An agent works within them. Skipworth, who moved into software from the semiconductor industry and now leads a zero-knowledge password management company for small and mid-sized businesses, has spent his career watching new technology get adopted faster than it gets governed. He sees the same pattern forming here. "People rely very heavily on these tools and don't ask what they've been handed the keys to," he says.
An agent has no access of its own. Whatever it can do, it can do because a person or team lent it credentials: a login, an API key, a token or a connection to a shared account. In a brokerage, where teams move fast and share tools, the quickest way to get an agent working is often to set it up under one licensee's login or a shared team account. It then inherits everything that account can reach, including client files, financial documents and communications, rather than a role scoped to its task. "Nobody sees a new user appear," Skipworth says. "The agent's access can quietly exceed its job, and nobody ever decided it should."
Skipworth treats credential management as foundational infrastructure rather than an optional extra, pointing to two trends that make loosely managed access riskier. First, AI-powered threats increasingly target credentials directly. "A lot of fake AI applications get installed without anyone vetting where they came from," he says. "Many are designed to harvest credentials and learn how people behave with them. It's not just grabbing a password. It's studying the habits around it." Second, AI is good at the reconnaissance attackers used to do by hand. "If logins live in a shared drive or a spreadsheet, or an agent's access sits behind a shared password, that's an easy find for an attacker with AI tools."
Brokerage leaders do not need technical expertise to assess an agent's reach, Skipworth says. They need to ask which systems it can touch, which client files it can see and which actions it can take, since reading, drafting, sending, editing and deleting carry very different risks. He recommends treating an agent like a new hire: defining its scope, naming an accountable owner and ensuring access can be revoked quickly and completely, which is far easier when the agent has its own credentials than when it shares a person's or a team's login. "None of this means avoiding AI," Skipworth says. "It means applying least privilege, ownership and offboarding to a new kind of user."
