AI Agents in Real Estate Brokerages Require Credential Oversight, Passpack CEO Warns

Real estate brokerages are increasingly turning to AI agents—software that can draft follow-ups, update CRMs, chase transaction paperwork, and keep pipelines moving. But according to Chris Skipworth, CEO of Passpack, a zero-knowledge password management company for small and mid-sized businesses, brokerage leaders are missing a critical distinction: an AI agent is not just a smarter chatbot. “A chatbot talks. An agent acts,” Skipworth says. “The ability to act is the whole story, and it’s also where the security question starts.”

Unlike chatbots, which can only discuss systems, AI agents operate inside them. To send an email, edit a record, file a document, or book a showing, an agent needs access to the CRM, inbox, transaction platform, or shared drive of client documents. That access, Skipworth argues, is where risk begins. “People rely very heavily on these tools and don’t ask what they’ve been handed the keys to,” he says. “Once you see an agent as a new kind of user with access to your systems, the right questions follow on their own.”

Every AI agent runs on borrowed access. It has no credentials of its own; whatever it can do, it can do because a person or team lent it a login, API key, token, or connection to a shared account. In fast-moving brokerage teams, the quickest way to get an agent working is often to set it up under one licensee’s login or a shared team account. The agent then inherits everything that account can reach—client files, financial documents, communications—rather than a role scoped to its task. “Nobody sees a new user appear,” Skipworth says. “The agent’s access can quietly exceed its job, and nobody ever decided it should.”

This is why Skipworth treats credential management as foundational infrastructure rather than an optional extra. He points to two trends that make loosely managed access riskier. First, AI-powered threats increasingly target credentials directly. “A lot of fake AI applications get installed without anyone vetting where they came from,” he says. “Many are designed to harvest credentials and learn how people behave with them. It’s not just grabbing a password. It’s studying the habits around it.” Second, AI excels at the reconnaissance attackers once did by hand. “One thing AI is very good at is spotting weaknesses in how an organization protects its credentials,” Skipworth says. “If logins live in a shared drive or a spreadsheet, or an agent’s access sits behind a shared password, that’s an easy find for an attacker with AI tools.”

For brokerage leaders, Skipworth recommends asking three clear questions about any agent: Which systems can it touch? Which client files can it see? Which actions can it take—reading, drafting, sending, editing, or deleting? He also advises treating an agent like a new hire: define its scope, assign an accountable owner, and ensure access can be revoked quickly and completely. “None of this means avoiding AI,” Skipworth says. “It means applying least privilege, ownership and offboarding to a new kind of user. Security is a wall that has to keep getting higher, and attackers are always looking for the ladder. Don’t hand them one.”

The implications extend beyond real estate. As AI agents become routine in operations, businesses across Texas and beyond will need to govern them with the same rigor as human employees. Passpack’s approach—strong, zero-knowledge credential security without an enterprise budget or dedicated IT team—aims to make that possible for small and mid-sized businesses. For leaders, the takeaway is clear: skip the question of how impressive the technology is and ask what it has been given the power to do, and who answers for it.