The Silent Proliferation: Enterprise Security Grapples with the Rise of Invisible AI Agents

As the enterprise landscape prepares for the full-scale integration of artificial intelligence, a new and largely invisible challenge is emerging within the corporate network. According to the recently released 2026 State of Agent Security Report, the sheer volume of AI-driven tools entering the workplace has reached a critical mass that traditional security frameworks are currently unequipped to handle. The report highlights a staggering trend: in the environments studied, approximately 1,280 third-party products now feature embedded AI capabilities. However, the most concerning finding is not the number of tools, but their visibility.

Of these 1,280 products, only 282 are integrated with single sign-on (SSO) protocols. The remaining thousand products—nearly 80% of the total—operate entirely outside the view of traditional identity infrastructure. This invisibility is not a result of intentional obfuscation by developers or users; rather, it is a fundamental limitation of current identity stacks. Most identity systems can only govern what authenticates through them, and the vast majority of modern AI agents never reach that authentication gate.

This gap represents a seismic shift in the cybersecurity industry. For several years, the conversation surrounding "AI security" was framed as a first-party problem. In this legacy model, a company made a conscious decision to adopt AI, procured the necessary licenses, and deployed a model behind a secure gateway. Security teams could then point their existing controls at a specific, known entity that the business had intentionally chosen to implement. Today, that model is being rendered obsolete. AI agents are no longer arriving through the front door of procurement; they are arriving as embedded features within software the enterprise already runs, often without any formal decision-making process.

Why the Decision Point Mattered More Than the Controls

Historically, the security of any enterprise tool relied on a specific "moment of adoption." This moment was the catalyst for every control in the security toolkit. Model scanning was performed because a model was selected; prompt inspection was implemented because a gateway was deployed; and acceptable-use policies were drafted because there was a clear adoption event to accept. This discrete moment provided security teams with a window for review, a surface to instrument with monitoring tools, and a clear owner to hold accountable.

AI agents, however, are increasingly bypassing this moment of adoption entirely. A prime example of this trend is Salesforce’s Slack Code, which launched in August 2026. The tool allows users to tag a coding agent directly into any Slack conversation. From there, the agent can read the shared context of the discussion, write code, and even open pull requests. The promise of such tools is "seamlessness," with marketing materials often highlighting that these agents inherit existing security models and admin controls without requiring any "additional IT lift."

From the perspective of a security team, this "seamlessness" is a double-edged sword. It describes an autonomous actor with significant reach—capable of accessing GitHub repositories and production infrastructure—whose governance is tied to something as fluid as a chat tool’s channel membership. Because the agent was "inherited" as a feature update rather than "adopted" as a new product, there was never a moment for IT to instrument the tool or evaluate its specific risks. The agent exists and acts, yet it never formally crossed a security threshold.

Three Launch Vectors, One Destination

To better understand this evolving threat landscape, security leaders are beginning to categorize agents into three distinct buckets: those that are bought, those that are built, and those that are inherited.

"Bought agents" are third-party tools specifically procured for a task, while "built agents" are developed internally using open frameworks on infrastructure the enterprise owns from end to end. While these two categories receive the most attention in security strategies, they represent the minority of actual AI usage. "Inherited agents" represent the third and largest bucket. These agents are shipped inside existing platforms via routine product updates.

Closely related to these are "configured agents," which consist of an enterprise’s own prompts and logic running on a third-party runtime, model, and connector. These two categories—inherited and configured—account for the overwhelming majority of AI adoption within the modern enterprise. They are growing exponentially as every major software-as-a-service (SaaS) application transforms into an agent platform. Crucially, "built agents" are the only ones with a repository to scan or a build process to gate. Inherited agents, by contrast, are already active by the time security teams become aware of them.

Regardless of how an agent originates, the destination is often the same. An agent that begins its life within a CRM system may eventually find itself reading data from a corporate data warehouse or writing entries into a ticketing system. Similarly, an agent assembled on a cloud platform may hold tokens that grant it access to Salesforce, Slack, and Google Drive. The enterprise application layer has become the primary execution environment for these agents, and it is a layer that no longer has fixed edges or clear boundaries.

The Anatomy of Agent Risk: The Scaffolding Problem

When evaluating the risks posed by these autonomous actors, security experts emphasize a critical distinction: an agent is composed of a reasoning model and the "scaffolding" that surrounds it. This scaffolding is what transforms a static model into an active participant in the digital environment. It determines what the agent is wired to, what APIs it can call, and the conditions under which it acts.

The 2026 State of Agent Security Report suggests that almost none of the actual risk lives within the AI model itself. Instead, the risk is concentrated in the scaffolding and the broader ecosystem in which that scaffolding resides. To address this, security professionals are being encouraged to move away from evaluating models and toward evaluating behavior and connectivity. This can be distilled into four essential questions that can be applied to any agent:

1. Identity: Is the agent registered or named? Does a specific human take responsibility for its actions, or does it run silently under the credentials of its creator?
2. Permissions: What is the agent’s scope of authority? Does it possess more permissions than it requires to function, and were those permissions—often inherited through OAuth scopes—granted intentionally?
3. Connectivity: What can the agent reach, both directly and transitively? This "blast-radius" question is perhaps the most difficult to answer, as it involves tracing the agent’s path through various products, data stores, and other agents it might interact with.
4. Activity: What is the agent actually doing in real-time? Security teams must judge an agent by its observed behavior rather than the intent described in its initial prompt.

The issue of connectivity is where agent security diverges most sharply from existing market solutions. Vendor questionnaires, prompt filters, and model scanners are designed to evaluate an agent in isolation. However, "reach" is not a property of the agent itself; it is a property of the environment. Understanding an agent’s risk requires a holistic view of the entire network ecosystem.

The Influence of Major Buyers and Regulatory Shifts

The push for better agent governance is not just coming from security researchers; it is being driven by some of the world’s largest and most influential software buyers. Patrick Opet, the global CISO of JPMorgan Chase, issued a stark warning to the software industry in 2025, identifying the third-party supply chain as a systemic risk. His concerns were rooted in real-world incidents where the bank had to isolate compromised suppliers to protect its core infrastructure.

Opet has since applied this same level of scrutiny to AI agents. His stance is that, ideally, an agent should be granted a distinct identity but no entitlements by default. IT departments must be able to confirm exactly who an agent is acting on behalf of before it is permitted to touch any data or systems outside a strictly defined boundary. When an institution with the scale and influence of JPMorgan Chase identifies agents as a primary supply-chain risk, it sets a standard that quickly trickles down to the rest of the industry through security questionnaires and procurement requirements.

Regulators are following a similar trajectory. The European Union’s AI Act, with obligations phasing in through 2026, is built on the assumption that an enterprise can maintain a complete inventory of its AI systems. The Act requires organizations to name owners and provide evidence of oversight for their AI deployments. For many organizations, the current lack of visibility into inherited agents poses a significant compliance risk. An organization that cannot enumerate its agents simply cannot comply with the law.

The Move Toward Standing Capabilities

As the number of agents in the enterprise grows from dozens to thousands, traditional methods of oversight—such as manual spreadsheets and quarterly reviews—are becoming untenable. A single product update from a major vendor can instantly introduce thousands of new agents into a corporate environment, rendering a static inventory obsolete overnight.

To address this, the industry is shifting toward "standing capabilities." This involves moving to a model of continuous, live visibility that can answer critical questions in real-time: what agents are operating, what permissions have they inherited, what can they reach, and how has their behavior changed since yesterday?

Modern platforms are now being developed to provide this level of granular, environmental analysis. One such example is Reco, which utilizes a "Reco Graph" to connect every human and non-human identity, application, permission, and agent action into a single, unified view. In this model, "reach" becomes the primary unit of analysis rather than simple configuration.

For a decade, the cybersecurity industry focused on building defenses for the AI that enterprises chose to use. But as the population of "un-decided" agents grows to become the majority, the focus must shift. The challenge for the coming years will not be securing the models themselves, but securing the sprawling, interconnected ecosystem in which these agents now live and act. This shift marks the beginning of a new era in enterprise security—one where visibility is the only viable path to control.