Bring Your Own Agent: Your Employees' Assistants Are Already Logged In

Summary: Personal AI agents from vendors including OpenAI's Dots, xAI's GrokBot, Meta's Muse, Instinct, and the open-source OpenClaw are being connected to corporate systems by employees without tickets, and none of the truly personal agents appear in the relevant admin console. The article argues these agents act on company systems in the employee's name, making this an identity problem rather than a device problem, and notes that Muse runs a dedicated VM with a Sentinel guard that enforces the user's policy rather than the employer's, leaving corporate session tokens on someone else's computer.
What's compelling: An agent that signs in as an employee is indistinguishable from that employee to your existing controls, and the article states it is likely in your systems today whether you can see it or not. The gap it names is concrete: there is still no reliable way to tell whether the identity signing in with a username and password is an employee or their agent.

Read the original at The Hacker News ↗