The Invisible AI Agent Problem: Governing Inherited and Unauthenticated SaaS Runtimes

Enterprise environments are facing a critical inflection point in identity management, driven by an unmonitored surge in third-party AI agent security risk. Data from the 2026 State of Agent Security Report reveals that out of approximately 1,280 third-party SaaS products embedding AI capabilities in corporate environments, only 282 pass through single sign-on (SSO). The remaining thousand agents exist completely outside traditional identity infrastructure—not due to deliberate evasion, but because enterprise identity stacks only govern software that explicitly authenticates through them.

For years, security teams designed controls around a clear decision point: a team procured an AI model, deployed it behind an API gateway, and applied model scanning, prompt filters, and acceptable-use policies. Autonomous agents do not follow this deployment lifecycle. They arrive unannounced through routine product updates inside software the business already uses, creating a massive perimeter of invisible non-human identities (NHIs) executing logic across enterprise data silos.

The Shift to Shadow AI Agents in Enterprise Platforms

The primary driver of this visibility gap is the mechanism by which agents enter the enterprise. Security architectures generally classify agents into three origin categories:

• Inherited agents: AI capabilities pushed directly into existing SaaS platforms via vendor software updates.
• Configured agents: Custom prompts, workflows, and API connectors deployed on third-party runtimes and vendor-managed infrastructure.
• Built agents: Custom autonomous frameworks deployed on enterprise-owned cloud infrastructure.

While built agents leave an artifact trail—such as code repositories, build pipelines, and container registries that security teams can gate—inherited and configured agents account for the vast majority of enterprise adoption.

A prime example is Salesforce’s Slack Code feature, launched in August 2026. The platform allows users to pull a coding agent directly into any channel, where it reads conversation history, generates code, and automatically opens pull requests in linked repositories. Because the vendor promises seamless integration using Slack’s native permissions without requiring additional IT overhead, no adoption review is triggered. Security teams are left unaware that a new autonomous actor now possesses reach extending from chat channels directly into GitHub and production infrastructure.

Transitive Reach and Non-Human Identity Exploitation

The technical risk in autonomous agents rarely stems from the underlying reasoning model itself; it lives in the surrounding scaffolding—the execution environment, system prompts, API connectors, and inherited credentials.

When an agent executes actions, it typically operates under the OAuth tokens or session permissions of the user who invoked it, or under a broad service account provisioned during vendor setup. This architecture creates three severe vulnerabilities:

1. Cross-Domain Transitive Reach: An agent instantiated within a CRM can be granted read access to a data warehouse and write access to an enterprise ticketing system. If an attacker tampers with input data in the CRM or ticketing system (such as via indirect prompt injection), the agent can be coerced into exfiltrating sensitive data across platform boundaries.
2. Over-Privileged Non-Human Identities: Agents frequently inherit broad, persistent OAuth scopes (e.g., repo:write, channel:history, drive.readonly) without granular, time-bound access controls. Because these tokens do not require interactive multi-factor authentication (MFA) after initial grant, compromising or misdirecting the agent grants immediate lateral movement across connected enterprise apps.
3. Identity Spoofing and Non-Repudiation Failure: Without a distinct identity registered in the central Identity Provider (IdP), agent activities appear in system logs under the human user’s identity or a generic platform service principal. This makes distinguishing legitimate human behavior from automated or malicious agent activity extremely difficult during incident response.

These risks have caught the attention of enterprise CISOs and regulatory bodies alike. Following high-profile third-party supply chain compromises, Patrick Opet, global CISO of JPMorgan Chase, signaled a shift in how institutions handle non-human identities. The bank’s posture requires that third-party agents receive zero default entitlements, forcing IT teams to verify and scope the exact identity an agent acts on behalf of before granting downstream access. Simultaneously, enforcement of the EU AI Act through 2026 mandates that organizations maintain an accurate inventory of all AI systems, assign named human owners, and prove continuous oversight—an impossible task when hundreds of agents run unauthenticated behind the scenes.

Governing Agent Scaffolding and Reducing Blast Radius

Spreadsheets, periodic vendor questionnaires, and point-in-time risk assessments cannot scale to manage thousands of inherited agents. Security teams must move toward continuous, graph-based visibility that maps how identities, permissions, and runtimes connect across applications.

To establish control over shadow AI agents, security operations should evaluate every discovered integration against four fundamental criteria:

• Explicit Ownership: Is the agent registered to a named human business owner, or is it executing tasks anonymously under elevated ambient permissions?
• Scope Minimization: What OAuth scopes and API keys did the agent inherit at creation, and can those privileges be restricted strictly to read-only or task-specific roles?
• Transitive Mapping: What systems, database connections, and downstream APIs can the agent reach directly or transitively if its context is manipulated?
• Behavioral Auditing: Is the agent’s execution volume, API calling pattern, and data movement consistent with its intended functional scope?

Organizations must implement continuous identity mapping tools—such as Reco Graph or identity threat detection and response (ITDR) platforms—to visualize relationships between human users, service accounts, and embedded AI runtimes in real time. Additionally, security administrators should update consent policies within Microsoft Entra ID, Google Workspace, and Salesforce to block automatic user-level consenting of unapproved OAuth applications, ensuring that any third-party app requesting agent-level execution scopes undergoes mandatory security review.