The rapid proliferation of artificial intelligence within corporate environments has introduced a profound structural vulnerability that traditional identity and access management systems are entirely unprepared to handle. According to recent data compiled for the 2026 State of Agent Security Report, approximately 1,280 third-party products currently embed AI capabilities across the studied enterprise ecosystems. Of that total, only about 282 sit behind a single sign-on system. The remaining thousand operate invisibly to standard identity infrastructure by default.
This oversight is not the result of deliberate concealment or malicious intent on the part of vendors. Rather, it stems from a fundamental architectural limitation: a traditional identity stack can only govern what explicitly authenticates through it. Because the vast majority of modern AI agents never pass through these traditional authentication gateways, they exist entirely off the grid of standard corporate oversight.
This expanding gap represents the clearest manifestation of a fundamental shift that the cybersecurity industry is only now beginning to fully recognize and articulate. For several years, solutions addressing "AI security" were designed to solve a straightforward, first-party problem. Enterprises would consciously decide to adopt a specific AI tool, procure enterprise licenses, deploy a centralized model behind a secure gateway, and direct security teams to apply standard controls to the technology chosen by the business.
Autonomous agents, however, do not arrive through this orderly procurement channel. Instead, they slip into the enterprise quietly, embedded directly inside software platforms and productivity suites that the organization is already running daily. They arrive without a formal corporate decision, bypassing the traditional procurement and risk-assessment checkpoints that typically trigger security reviews.
Why the Decision Point Mattered More Than the Controls
Historically, every control within the first-party security toolkit has relied on the existence of a definitive adoption milestone. Model scanning protocols assume that a specific model was intentionally selected; prompt inspection tools assume that a secure gateway was deliberately deployed; and acceptable-use policies assume that there was a formal corporate adoption process to regulate. That initial decision point historically provided security departments with a critical window for review, a tangible surface area to instrument, and a designated business owner to hold accountable.
Autonomous agents systematically bypass this crucial moment of introduction. A prime example of this dynamic is illustrated by platform updates such as Salesforce’s Slack Code, which allows any user to tag a coding agent directly into an active conversation. Upon invocation, the agent reads the shared context of the thread, writes the required code, and opens a pull request without further human intervention.
Public announcements for such tools typically emphasize that agents inherit the host platform’s built-in security models, user permissions, and administrative controls from day one, requiring no additional IT configuration. When read by a seasoned security team, however, that exact capability description paints a starkly different picture. It outlines an autonomous software actor equipped with broad, direct reach into core code repositories like GitHub and underlying production infrastructure, yet its primary governance mechanism is nothing more sophisticated than a standard chat tool’s channel membership. Because the tool was bundled into an existing platform update, there was nothing for security teams to instrument, simply because there was no formal adoption decision to intercept.
Three Launch Vectors, One Unified Destination
Enterprise security leaders have historically attempted to categorize artificial intelligence initiatives into two neat buckets: tools that are bought off-the-shelf and applications built internally. However, a third and vastly larger category now dominates the landscape: inherited agents.
Inherited agents are those that ship directly inside pre-existing enterprise platforms via standard product updates and feature expansions. Configured agents, meanwhile, represent an enterprise’s proprietary prompts and custom logic operating on external runtimes, models, and third-party data connectors. Built agents—those constructed from scratch using open frameworks on infrastructure fully owned and operated by the enterprise end-to-end—make up the smallest and slowest-growing category, yet they remain the only ones that present a traditional code repository to scan and a build pipeline to gate.
The first two categories account for the overwhelming majority of modern enterprise adoption and are expanding exponentially as every major enterprise application aggressively transforms into an agent platform. Yet, regardless of their origin vector, all agents ultimately share the same operational destination. An autonomous agent born natively within a customer relationship management system inevitably ends up reading corporate data warehouses and writing directly to ticketing platforms. Similarly, an agent assembled on a cloud development platform frequently ends up holding persistent tokens to external productivity suites, communication tools, and document storage systems. The enterprise application layer is where all of these operations ultimately execute, and that layer possesses no fixed operational edges.
Evaluating Risk Through Identity, Permissions, Connectivity, and Activity
Every functional agent consists of two distinct components: the foundational model that handles complex reasoning and the surrounding software scaffolding that transforms a passive model into an active participant. This scaffolding determines what the model is wired into, what external functions it is permitted to call, and precisely when it takes action. Virtually none of the actual security risk resides within the model itself; instead, the risk lives entirely within the scaffolding and the complex ecosystem in which that scaffolding operates.
Assessing this exposure requires shifting away from traditional model-centric evaluations and focusing on four core operational areas: identity, permissions, connectivity, and activity.
Identity addresses whether the agent is properly registered anywhere within the organization. When security teams ask whose agent a specific tool is, the key indicator is whether a named human being takes ownership, or whether the agent silently executes under the identity of whoever originally deployed it.
Permissions evaluate what the agent is authorized to do and whether those privileges exceed its operational necessity. Security teams must determine whose specific OAuth scopes and administrative roles the agent inherited upon creation, and whether those grants were established intentionally.
Connectivity addresses the broader scope of what the agent can reach, both directly and transitively, through the various products, authorization grants, data stores, and secondary agents it touches. This is fundamentally a blast-radius question, and it is rarely answerable simply by reviewing an agent’s individual configuration screen. Connectivity is what separates modern agent security from traditional security tooling, because reach is a systemic property of the broader environment rather than an isolated attribute of the agent itself.
Activity focuses on what the agent is actually doing in practice and whether that behavior aligns with normal operational expectations, judged by empirical actions rather than the theoretical descriptions outlined in its system prompts. Standard vendor questionnaires, basic prompt filters, and isolated model scanners are fundamentally unequipped to evaluate these systemic properties because they assess agents in total isolation.
The Push from Enterprise Buyers and Regulatory Bodies
Industry leaders with massive technological footprints have already begun shifting their security posture to address these systemic risks. Patrick Opet, the global chief information officer and CISO of JPMorgan Chase, issued a stark warning to the broader software industry, noting that the third-party supply chain had evolved into a systemic vulnerability serious enough to require isolating compromised suppliers. Opet has since applied this same rigorous scrutiny to autonomous agents, advocating an operational standard where an agent receives a verified identity but zero default entitlements, requiring explicit IT confirmation of the human it represents before it is permitted to touch anything outside a strictly defined boundary. When a financial institution of that scale identifies autonomous agents as a primary supply-chain risk, that requirement rapidly cascades into the security questionnaires faced by organizations across every other sector.
Regulatory bodies are simultaneously operating on similar baseline assumptions. The enforcement mechanisms of the European Union AI Act phase in with the explicit expectation that modern enterprises maintain the capability to comprehensively inventory their AI systems, designate clear human ownership, and evidence continuous oversight. Any organization that lacks the technological capability to accurately enumerate and map its deployed autonomous agents will find itself unable to demonstrate regulatory compliance.
Toward Continuous Discovery and Ecosystem Visibility
Approaches that rely on manual spreadsheets and periodic quarterly reviews to track a handful of agents quickly collapse when an organization scales to hundreds of tools, and an enterprise is frequently only a single product update away from managing thousands. The capability required to maintain visibility in this environment is a live, continuously refreshed answer to what software is currently operating, what permissions each agent has inherited, what resources it can reach directly or through multi-step chains, what actions it is actively performing, and how all of those parameters have shifted since the previous day.
Modern security platforms are increasingly engineered around this exact map of the enterprise ecosystem. Solutions such as the Reco Graph connect every human and non-human identity, application, permission, and agent action into a unified live view, shifting the fundamental unit of analysis from static configuration settings to dynamic operational reach.
While the security industry spent much of the past decade building defensive measures for the artificial intelligence that enterprises intentionally chose to procure, the unmanaged agents that arrived without explicit authorization now represent the dominant population within corporate networks. The foundational analysis and series exploring these challenges, titled Into the Expanse, provides deeper examination into the origins of these agents, governance strategies, adversary utilization, and capital prioritization.
