Third-Party AI Agents Slip Through Identity Controls
Enterprise environments now host roughly 1,280 third-party products that embed AI, according to the 2026 State of Agent Security Report. Only 282 of those products are behind single sign-on (SSO), leaving the remaining 998 effectively invisible to the identity stack that normally governs access. The invisibility stems from the fact that most agents do not authenticate through the identity infrastructure; they are embedded in existing software and operate without a formal adoption decision.
Attack Path and Exposure
Agents arrive in three ways: bought, built, and inherited. The inherited category is the largest and fastest growing. Inherited agents ship inside existing platforms via product updates. Because they are delivered as part of the platform, they inherit the platform’s permissions and admin controls from day one, but those controls are often limited to the chat or collaboration tool that hosts the agent. For example, Salesforce’s Slack Code, released in August 2026, lets a user tag a coding agent into any conversation. The agent reads the shared context, writes code, and opens a pull request. The announcement claims the agent "inherits Slack’s built-in security model, permissions, and admin controls from day one, without any additional IT lift." In practice, the agent gains reach into GitHub and production infrastructure through the channel membership of Slack, a path that bypasses traditional identity governance.
Because the agent does not go through an SSO flow, it does not register with the identity provider. Consequently, the identity stack cannot enforce multi-factor authentication, conditional access, or least-privilege policies for the agent. The agent can read data warehouses, write to ticketing systems, and hold tokens to Salesforce, Slack, and Drive, all without being visible to the security team.
Evidence and Observed Behavior
The 2026 State of Agent Security Report notes that 282 of the 1,280 agents sit behind SSO, while the other thousand are invisible to identity infrastructure by default. The report attributes this gap to the fact that an identity stack can only govern what authenticates through it, and most agents never do.
Security controls designed for first-party AI assume a decision point: model scanning presumes a model was selected, prompt inspection assumes a gateway was deployed, and acceptable-use policy assumes an adoption decision was made. Agents skip this decision point. They arrive inside software the enterprise already runs, without a formal adoption process. As a result, there is nothing for security to instrument or an owner to name.
Mitigation and Detection Steps
- Inventory all embedded AI agents – Use application dependency scanning to identify third-party products that embed AI.
- Map agent permissions – For each identified agent, document the data sources it can read and the systems it can write to.
- Enforce least-privilege at the platform level – Configure the host application (e.g., Slack, Salesforce) to restrict agent scopes to the minimum required for functionality.
- Implement runtime monitoring – Deploy telemetry that flags anomalous data exfiltration or unexpected API calls originating from agent processes.
- Apply network segmentation – Isolate the networks that host third-party agents from critical production systems.
- Review update channels – Treat platform updates that introduce new agents as high-risk change events and subject them to the same change-management process as other software updates.
Practical Consequence
Because agents bypass identity controls, traditional security tools that rely on SSO logs and identity-based policies will miss activity from these actors. Security teams must therefore shift from identity-centric monitoring to agent-centric visibility, ensuring that every AI component, regardless of its origin, is accounted for in the security posture.
Open Question
How will future identity platforms evolve to detect and govern agents that do not authenticate through them? The current blind spot suggests a need for new mechanisms that can surface embedded AI activity without requiring a formal adoption decision.
How SMB Cybersecurity Complexity Threatens Advanced Protection Goals
Related coverage
- Microsoft Twitter Account Hijacked for Crypto Scam Featuring Clippy
- Threat Actors Exploit AI Chatbot Security Vulnerabilities for Mass Disinformation and Phishing Campaigns
- FBI Reveals China-Linked Integrity Technology Group Operated Portal Exposing Stolen Emails