Not by an identity team, nor by a security professional. This one is built by someone in accounts at a mid-sized company.
The agent's job is relatively simple: read an inbox, match invoices against the ERP, and post a daily summary to Slack. And since a frontier model was used to build it, it's a one-shot, 10-minute task.
Nobody in security knows the agent exists. In a survey of 418 IT and security professionals commissioned by Token from the Cloud Security Alliance in January 2026, 68% reported having strong visibility into their AI agents.
Yet 82% had found agents they didn't know about in the past year. The evolution of agents is so rapid that the security playbooks are being written on the go. The people responsible for agent security need to figure things out in production, one problem at a time.
