The Silent Proliferation: Enterprise Security Grapples with the Rise of Invisible AI Agents

As the enterprise landscape prepares for the full-scale integration of artificial intelligence, a new and largely invisible challenge is emerging within the corporate network. According to the recently released 2026 State of Agent Security Report, the sheer volume of AI-driven tools entering the workplace has reached a critical mass that traditional security frameworks are currently unequipped to handle. The report highlights a staggering trend: in the environments studied, approximately 1,280 third-party products now feature embedded AI capabilities. However, the most concerning finding is not the number of tools, but their visibility.

Of these 1,280 products, only 282 are integrated with single sign-on (SSO) protocols. The remaining thousand products—nearly 80% of the total—operate entirely outside the view of traditional identity infrastructure. This invisibility is not a result of intentional obfuscation by developers or users; rather, it is a fundamental limitation of current identity stacks. Most identity systems can only govern what authenticates through them, and the vast majority of modern AI agents never reach that authentication gate.

This gap represents a seismic shift in the cybersecurity industry. For several years, the conversation surrounding "AI security" was framed as a first-party problem. In this legacy model, a company made a conscious decision to adopt AI, procured the necessary licenses, and deployed a model behind a secure gateway. Security teams could then point their existing controls at a specific, known entity that the business had intentionally chosen to implement. Today, that model is being rendered obsolete. AI agents are no longer arriving through the front door of procurement; they are arriving as embedded features within software the enterprise already runs, often without any formal decision-making process.

Why the Decision Point Mattered More Than the Controls

Historically, the security of any enterprise tool relied on a specific "moment of adoption." This moment was the catalyst for every control in the security toolkit. Model scanning was performed because a model was selected; prompt inspection was implemented because a gateway was deployed; and acceptable-use policies were drafted because there was a clear adoption event to accept. This discrete moment provided security teams with a window for review, a surface to instrument with monitoring tools, and a clear owner to hold accountable.

AI agents, however, are increasingly bypassing this moment of adoption entirely. A prime example of this trend is Salesforce’s Slack Code, which launched in August 2026. The tool allows users to tag a coding agent directly into any Slack conversation. From there, the agent can read the shared context of the discussion, write code, and even open pull requests. The promise of such tools is "seamlessness," with marketing materials often highlighting that these agents inherit existing security models and admin controls without requiring any "additional IT lift."

From the perspective of a security team, this "seamlessness" is a double-edged sword. It describes an autonomous actor with significant reach—capable of accessing GitHub repositories and production infrastructure—whose governance is tied to something as fluid as a chat tool’s channel membership. Because the agent was "inherited" as a feature update rather than "adopted" as a new product, there was never a moment for IT to instrument the tool or evaluate its specific risks. The agent exists and acts, yet it never formally crossed a security threshold.

Three Launch Vectors, One Destination

To better understand this evolving threat landscape, security leaders are beginning to categorize agents into three distinct buckets: those that are bought, those that are built, and those that are inherited.