AI Agent Problem

Your security team can't name every AI agent running inside your company right now.

Neither can you, probably.

A CSA survey from April found 53% of organizations have had AI agents exceed their intended permissions. Not hacked. Not breached in the usual sense. Just doing more than they were told to.

A separate CSA study, commissioned by Token Security, found 82% of enterprises discovered AI agents they didn't know existed. Not last year. In the past year. Ongoing.

Here's the part that should actually bother you.

Most of these agents were never approved by IT or security. Someone on marketing spun one up to draft emails. It got read access to the CRM along the way. Nobody logged it. Nobody owns it. It's still running.

Fun fact. Only 11% of organizations automatically block an agent when it exceeds scope. The rest either log it after the fact or ask a human to approve something that already happened.

That's not governance. That's a diary.

I we'll notice eventually" isn't a security model.

Shadow IT used to mean someone installed Dropbox without asking.

Shadow AI means an agent has standing access to your customer data and nobody remembers approving it.

If you've ever found an agent in your company you didn't know existed, tell me how you found out.

Read the full article using the link in the description.