The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't
A new report finds that around 1,000 AI-embedded third-party products in typical enterprises sit outside SSO and identity controls, creating ungovernable shadow-agent sprawl that traditional security stacks cannot see — a critical gap as NIS2 supply-chain obligations take effect.
Summary written by editorial AI · Source link below
In environments studied for the 2026 State of Agent Security Report, roughly 1,280 third-party products now embed AI. About 282 of them sit behind single sign-on. The other thousand are invisible to identity infrastructure by default, not because anyone hid them, but because an identity stack can only govern what authenticates through it, and most agents never do.
That gap is the clearest
Editorial Analysis
The proliferation of unsanctioned AI agents embedded in third-party software creates an identity and governance blind spot that most European enterprises are not yet equipped to detect or manage, with direct NIS2 supply-chain implications.
Conduct an enterprise-wide audit of third-party products for embedded AI agent capabilities and ensure each is integrated into your identity governance and vendor risk frameworks.
Most enterprises unknowingly host ~1,000 AI agents from third-party software outside identity controls — a regulatory and operational risk demanding board-level visibility.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at THN (Feedburner) in a new tab.
More from the AI Security Desk
- Anthropic discloses 2 months old fake tip to police among new rogue AI incidents10 Oct
- Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws10 Oct
- How to keep AI agents within their permissions9 Oct
- Social Engineering AI Agents: The New BEC for 20269 Oct
- [NEU] [mittel] vllm: Mehrere Schwachstellen9 Oct