Enterprises spend millions securing in-house LLMs, but the third-party agent problem leaves over a thousand autonomous SaaS tools invisible to identity stacks.
Senior Technology Analyst
Enterprises spend millions securing in-house LLMs, but the third-party agent problem leaves over a thousand autonomous SaaS tools invisible to identity stacks.
For the past two years, enterprise security chiefs poured vast budgets into a defensive perimeter built around a singular assumption: that artificial intelligence inside the enterprise is something the enterprise intentionally procures, hosts, and monitors. Security teams stood up dedicated AI gateways, audited internal model weights, and wired LLM prompts into custom telemetry pipelines. Yet data released from the 2026 State of Agent Security Report exposes how radically disconnected that defense is from operational reality.
Modern enterprises are facing what researchers call the third-party agent problem. In corporate IT estates surveyed for the report, an average of 1,280 third-party software products embed autonomous AI capabilities. Of those, barely 282 interface with enterprise single sign-on (SSO) systems or central identity providers. The remaining thousand live entirely in the enterprise blind spot—not because rogue employees actively concealed them, but because existing enterprise security architecture was engineered to govern identities, not autonomous background delegates.
The fundamental disconnect stems from how software vendors rolled out generative and agentic features over the past eighteen months. Traditional SaaS security relies on a clear protocol sequence: an employee authenticates via Okta, Entra ID, or Ping Identity, receiving an ephemeral session token with scoped permissions. Security assertion markup language (SAML) assertions and OpenID Connect (OIDC) claims give visibility to security operations centers (SOCs), which log who accessed what resource, from which IP, and at what time.
Third-party agents break this chain of custody entirely. When a cloud-hosted customer relationship management tool, an automated code analysis engine, or a project management suite updates its platform to include an autonomous background assistant, that assistant does not generate a separate SAML assertion. Instead, the agent runs server-side on the vendor’s infrastructure, executing operations under persistent API keys, service accounts, or ambient delegated authority established months or years earlier.
An identity stack can only govern what authenticates through it. When an agent running inside a third-party billing platform queries an enterprise database, synthesizes financial projections, and dispatches external webhooks based on incoming vendor telemetry, the customer’s identity provider records zero authentication events. The agent is invisible by architecture, operating within a governance void where enterprise access control lists simply do not exist.
Most enterprise security programs responded to generative AI by deploying specialized proxies and prompt firewalls. These tools intercept employee prompts heading toward public endpoints like OpenAI or Anthropic, scanning for social security numbers, API tokens, and trade secrets. If a software engineer tries to paste source code into an unsanctioned chatbot, the inline proxy blocks the request.
That entire defensive layer is irrelevant against the third-party agent problem. These background assistants rarely interact directly with the corporate workforce through an enterprise browser session. Instead, their communication flows between machine endpoints. A vendor's agent ingests data through backend database connectors, webhooks, and third-party API integrations that security teams already whitelisted as standard SaaS plumbing.
Consider a scenario documented in recent incident response reports: an enterprise human resources platform quietly enabled an autonomous agent to summarize candidate profiles and sync interview notes across corporate calendars and document repositories. The organization had strict Data Loss Prevention (DLP) filters applied to employee endpoints. However, the HR platform had OAuth read-and-write permissions to corporate Google Workspaces. When the vendor's internal agent experienced an indirect prompt injection attack via a maliciously crafted resume submitted through a public careers portal, the agent pulled internal company documentation and posted it to an external endpoint. The enterprise proxy saw nothing, because the compromise took place entirely across cloud-to-cloud interfaces outside the corporate network perimeter.
Security engineers often assume that least-privilege principles will inherently contain rogue vendor agents. If an enterprise gives a third-party application read-only access to a specific cloud bucket, conventional wisdom suggests any agent embedded in that application remains bound by those limits.
In practice, authorization within enterprise SaaS is notoriously coarse. When enterprise administrators integrate tools like Slack, Jira, Salesforce, or GitHub, the permission models typically operate at the tenant or workspace tier rather than the micro-action tier. An application granted access to read tickets frequently gains ambient visibility over every comment, attached log file, and internal link shared across the workspace.
When vendors bolt autonomous planning models onto these existing access tokens, the risk profile shifts from passive data exposure to active execution risk. Modern agent architectures utilize recursive reasoning loops, tool-calling interfaces, and dynamic API discovery. An agent tasked with resolving customer service tickets no longer just displays text; it creates tickets, modifies user groups, modifies calendar invitations, and triggers external CI/CD pipelines.
This behavior forms what security architects call a "shadow graph"—an unmapped web of autonomous machine delegates executing changes across enterprise systems. Because these tools run continuously without human-in-the-loop triggers, traditional anomaly detection engines struggle to distinguish legitimate vendor automation from privilege escalation attacks orchestrated by an adversarial model.
Remediating the third-party agent problem requires enterprises to abandon the assumption that software capabilities remain static after vendor procurement. Security teams must pivot from identity-centric auditing to continuous runtime capability discovery.
First, procurement and vendor risk assessments must mandate explicit agent disclosures. Enterprisewide SaaS audits need to evaluate not just where vendor data is stored at rest, but whether vendor workloads execute autonomous inference and tool-calling on enterprise data. If a vendor introduces an autonomous capability into an existing production tier, contracts should treat the update as a major architectural change requiring re-certification.
Second, organizations must systematically dismantle long-lived, ambient OAuth grants. Instead of granting enterprise SaaS platforms broad, permanent read-write scopes across collaboration platforms, engineering teams are shifting to fine-grained, ephemeral credentials governed by zero-trust workload postures. If a platform requires write access to an enterprise repository, that access should be bound to explicit human approvals or signed hardware tokens rather than perpetual cloud tokens.
Finally, monitoring must shift from browser-edge proxies to backend API gateways. By instrumenting deep API telemetry across all inbound and outbound machine integrations, SOC analysts can spot irregular API call sequences, anomalous token consumption, and unexpected cross-system hops that indicate an unmonitored agent is acting outside its intended operational envelope.
As autonomous agents transition from experimental research prototypes into ubiquitous features across the global software supply chain, enterprise visibility will continue to degrade if organizations rely solely on legacy identity platforms. The AI that corporations build and deploy internally represents only a fraction of the machine cognition interacting with corporate assets. Until security programs govern the agents they inherited alongside the ones they purposely bought, the perimeter remains wide open.
This report was independently synthesized, fact-checked, and expanded with technical mitigation guidance and risk evaluations by the Zero Hour Tech editorial desk. Initial reporting, vendor bulletins, or threat telemetry were tracked from thehackernews.com .
Contributing editor at Zero Hour Tech, specializing in cybersecurity & privacy analysis, vulnerability response, and emerging software paradigms.
View Full Profile & Articles →
A massive campaign weaponizing malicious GitHub Actions workflows compromised high-profile maintainer accounts to steal cloud secrets and repository tokens.
A multi-state TP-Link router security lawsuit alleges the networking giant misled buyers regarding firmware vulnerabilities and its operational ties to China.
Get our concise weekly security briefings covering newly disclosed vulnerabilities, exploit mechanics, and actionable system hardening guides.
100% Privacy guaranteed. One-click unsubscribe at any time.