Report Finds Gaps in Enterprise AI Agent Oversight and Visibility
Summary
A month-long review of AI-agent use at one software company found widespread non-engineer use, many tool calls without human approval, gaps in agent logs versus kernel telemetry, and extensive use of third-party MCP servers.
Key points
- Half of employees using AI agents worked outside engineering; among non-engineers, an average of 42% had agents run code, builds, package installs, or cloud or cluster commands.
- More than 60% of tool calls ran without human approval: 52% were screened by Claude Code's auto-mode classifier, while 9% had permission prompts turned off.
- The kernel captured seven processes per logged tool call. Agent logs omitted credential-file reads 82% of the time, while the kernel recorded every read.
- Third-party registries or vendors supplied 47% of the MCP servers in use; connected servers had agent access and could update silently.
- More than 50% of AI spending went to duplicative processes and capabilities.
- The article recommends monitoring installs and CLI calls, providing sandboxed build paths, and scoping agents and tools according to what they can access and change.
Article Details
- Publisher
- Sysdig
- Scope
- One software development company’s enterprise AI agent usage over one month.
- Sample Size
- One organization.
- Key Statistics
- 50% of employees using AI agents worked outside the engineering department.
- Among non-engineering AI agent users, an average of 42% had an agent run code, a build, a package install, or a cloud or cluster command.
- More than 60% of tool calls ran without human approval: 52% were screened by Claude Code’s auto-mode classifier and 9% had permission prompts intentionally turned off.
- The kernel captured seven processes per logged tool call; for credential-file reads, the agent log had no entry 82% of the time, while the kernel logged every read.
- 47% of MCP servers in use came from third-party registries or vendors.
- Recommendations
- Monitor installs and CLI calls, and provide non-engineers with an approved, sandboxed path for building.
- Assess risk profiles at different levels and allow tools, agents, and extensions according to what they can reach and change.
- Use kernel-level process data alongside agent logs; do not treat agent-written logs as audit evidence.
- Track model use by team and user, and match model choice to the task to reduce duplicative processes and capabilities.
Vendors
Products
Claude CodeMore than 60% of this organization’s tool calls ran without a human approving them — 52% screened by Claude Code’s auto-mode classifier instead of a person, and 9% with permission prompts intentionally turned offSysdig AI DefenseWith early access to Sysdig AI Defense, one software development company spent a month looking at AI agent usage across their enterprise. Below is what they found.