Companies are discovering thousands of AI agents that nobody owns
Cyera says an inspection at a large financial company found thousands of AI agents that had spent more than six months inside highly sensitive data without the customer knowing they were there. SailPoint reports finding more than 10,000 agents at a Fortune 500 company, 70% without an identifiable owner. These are vendor accounts rather than independently audited measurements, and neither incident caused known harm. Their significance is more prosaic: the agents were legitimate fragments of the companies’ own systems that had become operationally invisible.
Traditional identity management starts with a stable employee or service account. An agent complicates both sides of that relationship. It may act on behalf of a person for one task, spawn subordinate processes, reuse the person’s credentials and continue operating after the initiating workflow has ended. A valid credential proves what the software can access; it does not prove that the current action still reflects the user’s intent.
The emerging control pattern therefore combines identity with task scope. Every agent is tied to the human or system that authorised it. A separate layer evaluates the requested task and issues temporary, least-privilege permissions to the files and tools required. Those rights expire or are revoked when the task finishes. Monitoring then looks for agents with no owner, permissions inconsistent with their purpose, or behaviour outside the authorised sequence. The aim is containment: a malfunctioning or compromised agent should not possess enough durable authority to cause large-scale damage.
The market is consolidating around that problem. Cyera paid $1bn for Oasis Security, which manages so-called non-human identities. Workday bought C1.ai; Okta acquired Permisio; SailPoint acquired Entro; and larger security groups including Palo Alto Networks and CrowdStrike have also bought agent-security capabilities. The acquisition wave says enterprises are treating agent identity as an extension of production security rather than an optional AI dashboard.
The difficult part is enforcement across heterogeneous systems. Labelling an agent after discovery does not reveal which human approved its present action, whether its delegated credentials are still justified or what downstream agents it created. Useful governance requires an inventory that updates continuously, short-lived credentials issued outside the model, immutable logs linking actions to authorisation, and a kill switch that does not depend on the agent obeying. The safety boundary is not a better prompt. It is an identity system capable of saying exactly who authorised what, for how long, and with which reversible powers.