Third-Party AI Agents Often Evade Enterprise Identity Controls, Article Warns

Summary

The article argues that many third-party AI agents bypass traditional identity controls and recommends continuous visibility into their identities, permissions, connectivity, and activity.

Key points

• The environments studied reportedly contained about 1,280 third-party products embedding AI; only around 282 were behind single sign-on.
• The article distinguishes inherited agents embedded in existing products, configured agents using external runtimes, and agents built on enterprise-owned infrastructure.
• It argues that agent risk often comes from surrounding scaffolding, connections, and inherited permissions rather than the underlying model.
• It recommends reviewing each agent's identity, permissions, connectivity, and actual activity.
• The article says agents can reach systems and data beyond their host application, making their environmental access and potential blast radius important to assess.
• It calls for continuously updated inventories and visibility into agent access and behavior, citing governance and oversight obligations under the EU AI Act.

People

Vendors

Products