The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't
Summary: In environments studied for the 2026 State of Agent Security Report, roughly 1,280 third-party products now embed AI, and only about 282 of them sit behind single sign-on. The article argues that agents arrive inside software the enterprise already runs, without an adoption decision, so controls built for first-party AI - model scanning, prompt inspection, acceptable-use policy - have no moment to attach to.
What you should know: About a thousand AI-embedded products in these environments never authenticate through identity infrastructure, so they are invisible to the stack meant to govern them. JPMorgan Chase's global CISO has said an agent should get an identity but no entitlements by default, and the EU AI Act's obligations phasing in through 2026 presume an enterprise can inventory its AI systems and name their owners.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026