Imagine an AI agent being created. Not by an identity team, nor by a security professional. This one is built by someone in accounts at a mid-sized company. The agent’s job is relatively simple: read an inbox, match invoices against the ERP, and post a daily summary to Slack. And since a frontier model was used to build it, it's a one-shot, 10-minute task. Nobody in security knows the agent exists.
There’s nothing unusual about this. In a survey of 418 IT and security professionals commissioned by Token Security from the Cloud Security Alliance in January 2026, 68% reported having strong visibility into their AI agents. Yet 82% had found agents they didn’t know about in the past year.
Day One: How the agent got its access
Our agent needs access to three systems: email, the ERP, and Slack. It gets emails via the no-code builder, using an OAuth consent screen. The ERP is trickier, but not by much. The agent’s creator can generate a personal API key in minutes by following the AI’s very helpful instructions. Slack comes in through the builder’s own Slack connector, with one more consent screen.
That’s two of the four access paths John Donovan, former Head of Security, IT and Compliance at Zededa, lays out: riding a human’s session, using a delegated OAuth grant, utilizing static credentials, and acting through purpose-built agent identities. Real agents mix these paths, creating blind spots where database logs show a service account while SaaS audit logs show the user and the identity provider shows nothing.
Day Two: The review that never happened
The agent goes live the next morning. Nobody reviews it because nobody was asked to. Had someone looked, one test would have flagged it. In guidance from Amber Bennoui, Product Leader for AI and Cybersecurity at DataRobot, the agent violates the Agents Rule of Two published by Meta’s AI security team. It processes untrusted input, reaches sensitive systems, and can change state, all in one session.
Week Three: The malicious email no one opens
The Slack summaries are genuinely useful. Just then, an invoice lands in the inbox from a known vendor. Inside the attachment, in white text on a white background, is a note requesting an update to the ERP as the vendor changed its bank. No person reads that email, but the agent does, including the hidden text, and it makes the change. Joshua Copeland, a CISO and cybersecurity researcher, shows how instructions can ride in on content the agent reads.
That Thursday: Catching it
The bank change goes through on a Thursday. Chad Kalmes, CISO and CIO at Benchling, warns against baselining detection only on permissions. Instead, baseline on what the agent actually does. Two signals fire: first use of a write tool after three weeks of only reads, and a new sequence of reading an email then changing a payment record.
Day Sixty: Who approved this?
Two months later, the auditors pull the bank change and ask who approved it. Rajesh Seshadri Appikulam, Senior Director of Identity Security Services at Simeio, lists the four questions auditors ask: which agent, under what entitlement, with whose approval, and on whose authority. The record is thin. The ERP log shows the creator’s personal API key, and the OAuth grant remains live even after the owner moved teams.
The agent we followed is imaginary, but agents like it aren’t. More than 20 contributors, including security leaders at Roblox, Klaviyo, and Webflow, cover the field in the free Agentic Universe from Token Security.
