The Silent Proliferation: Enterprise Security Grapples with the Rise of Invisible AI Agents

"Bought agents" are third-party tools specifically procured for a task, while "built agents" are developed internally using open frameworks on infrastructure the enterprise owns from end to end. While these two categories receive the most attention in security strategies, they represent the minority of actual AI usage. "Inherited agents" represent the third and largest bucket. These agents are shipped inside existing platforms via routine product updates.

Closely related to these are "configured agents," which consist of an enterprise’s own prompts and logic running on a third-party runtime, model, and connector. These two categories—inherited and configured—account for the overwhelming majority of AI adoption within the modern enterprise. They are growing exponentially as every major software-as-a-service (SaaS) application transforms into an agent platform. Crucially, "built agents" are the only ones with a repository to scan or a build process to gate. Inherited agents, by contrast, are already active by the time security teams become aware of them.

Regardless of how an agent originates, the destination is often the same. An agent that begins its life within a CRM system may eventually find itself reading data from a corporate data warehouse or writing entries into a ticketing system. Similarly, an agent assembled on a cloud platform may hold tokens that grant it access to Salesforce, Slack, and Google Drive. The enterprise application layer has become the primary execution environment for these agents, and it is a layer that no longer has fixed edges or clear boundaries.

The Anatomy of Agent Risk: The Scaffolding Problem

When evaluating the risks posed by these autonomous actors, security experts emphasize a critical distinction: an agent is composed of a reasoning model and the "scaffolding" that surrounds it. This scaffolding is what transforms a static model into an active participant in the digital environment. It determines what the agent is wired to, what APIs it can call, and the conditions under which it acts.

The 2026 State of Agent Security Report suggests that almost none of the actual risk lives within the AI model itself. Instead, the risk is concentrated in the scaffolding and the broader ecosystem in which that scaffolding resides. To address this, security professionals are being encouraged to move away from evaluating models and toward evaluating behavior and connectivity. This can be distilled into four essential questions that can be applied to any agent:

1. Identity: Is the agent registered or named? Does a specific human take responsibility for its actions, or does it run silently under the credentials of its creator?
2. Permissions: What is the agent’s scope of authority? Does it possess more permissions than it requires to function, and were those permissions—often inherited through OAuth scopes—granted intentionally?
3. Connectivity: What can the agent reach, both directly and transitively? This "blast-radius" question is perhaps the most difficult to answer, as it involves tracing the agent’s path through various products, data stores, and other agents it might interact with.
4. Activity: What is the agent actually doing in real-time? Security teams must judge an agent by its observed behavior rather than the intent described in its initial prompt.

The issue of connectivity is where agent security diverges most sharply from existing market solutions. Vendor questionnaires, prompt filters, and model scanners are designed to evaluate an agent in isolation. However, "reach" is not a property of the agent itself; it is a property of the environment. Understanding an agent’s risk requires a holistic view of the entire network ecosystem.

The Influence of Major Buyers and Regulatory Shifts