Safety report of agents IA: 1,280 products, 282 with SSO; majority without identity control

A new report on the safety of IA agents presents a worrying but concrete picture: in the environments examined for the 2026 State of Agent Security Report There are about 1,280 third-party products that already incorporate IA capabilities; of these, only 282 pass through the single session start circuit (SSO) and the rest - almost a thousand - remains outside the direct reach of the identity infrastructure by default. In simple terms: most "agents" do not come through a controlled adoption process, but appear within existing applications such as product updates or inherited functions, and thus escape traditional governance tools.

This is not a problem of models - the report insists on it - but of ecosystem. An agent, explained in its fundamental parts, combines a model to reason with a "scaffolding" that makes it an actor: which systems can consult, which APIs can invoke, what credentials it uses and when it acts automatically. According to the document, almost all the practical risk lies in this scaffolding and in the connections that the agent inherits, not in the quality of the base model.

The immediate consequence is a gap in the dominant safety logic: the tools and processes that evaluated IA take a decision moment - a purchase, an integration, an entry door - that grants an instrumentation point and a responsible. The inherited agents don't go through that point. They are installed within platforms that the company already uses and, in many cases, operate with permits that come from the configuration of the host application or tokens stored in the environment, not from the corporate identity managed by IT.

Who does this affect? To any organization using large-scale third-party applications: CRM, chat platforms, productivity suites, cloud environments and application catalogues. The report mentions that agents born in a CRM can end up reading a data warehouse and creating tickets in management systems, and that agents deployed in the cloud end up hosting tokens with access to several applications. In regulatory terms, the inability to list and attribute IA systems also affects compliance: obligations such as those stipulated by the EU AI Act they assume that an organisation can invent its IA systems and demonstrate supervision.

The report also refers to statements by industry leaders that raise the risk to the systemic category: executives who have treated the software supply chain as a critical vector and now apply the same look to the agents are cited. If large actors require control over agents in their purchase and evaluation processes, this will transform questionnaires and contracts into risk indicators required for suppliers.

What is confirmed and what is estimate: the report figures (1,280 products with IA, 282 behind SSO) are the factual basis reported by the authors; the technical characterization of the problem - the scaffolding and connectivity approach to the model - is deployed as an analysis of the same report. The projections of exponential growth of inherited agents and the idea that current practices collapse when they climb are inferences motivated by authors and industry experts; they are estimates based on observable trends, not immutable certainties. What is still uncertain is the speed with which suppliers and regulators will implement effective countermeasures and how specific rules will evolve in different markets outside the EU.

From a technical point of view, the critical part is "reach": an agent can act directly on systems if he has inherited credentials, connectors or permissions. Classical tools - model scanners, prompt filters, point reviews - evaluate isolated components; do not measure impact chains that cross human and non-human identities, chained applications and permissions. This is the Achilles heel identified: the surface that matters is not the configuration perceived today, but what an agent can reach tomorrow.

Specific risks resulting from this architecture: exfiltration of data through agents with inherited permits, lateral movements provided by credentials used by agents, poorly configured automation that modifies production environments, and audit and governance erosion when the agent's actions are associated with the host application rather than an identifiable actor. At the operational level, manual management with spreadsheets and quarterly reviews becomes unviable when the number of agents is counted by hundreds or thousands.

What to do now, step by step? First, detect: implement a continuous inventory of agents and their permissions in real time, not spot reviews. Tools that correlate identities, applications and actions - the report quotes solutions designed to map that "graph" of relationships - are the initial piece to convert range into unit analysis. Second, identity and principle of minor privilege: require that any agent have a separate identity, provided by IT, and receive by default without permissions; the elevation must be explicit and audited. Third, runtime controls: restricts and records all connectors that allow an agent to reach sensitive systems, forcing business approvals and security reviews for each new connector. Fourth, secret management and rotation: ensure tokens and credentials used by platforms and agents in corporate vouchers with automatic rotation and restricted scope policies. Fifth, telemetry and response: centralize records of agent actions in your SIEM / EDR and define alerts for unusual access patterns or call chains between services.

At the contractual and supplier level, it requires visibility: clauses that require suppliers to document agents included in updates and to provide mechanisms to deactivate agent functions at the customer level. Do not trust traditional questionnaires: ask for inventory evidence and evidence that agents can be provided with neutralized identities until authorization.

For teams that plan investment, prioritize continuous discovery and automation of identity policies over static model scans. In the short term, operational mitigation (revoking unaudited tokens, limiting connectors, enabling logging) reduces the immediate risk. In the medium term, implement approval flows and plug of connectors from the supplier and work with legal / compliance to update contracts. In the long term, promote architectures that place the organization-controlled runtime in critical services, and press suppliers to ensure that their agent functions respect delegated identity models and audibility.

The regulatory and good practice agenda is already under way: the need for inventory and monitoring proposed by the EU AI Act and zero trust frameworks and identity management, such as NIST Zero Trust they offer applicable principles: continuous visibility, less privilege, segmentation and telemetry. Without these pillars, organizations will continue to be surprised by actors who never went through an adoption process.

In conclusion, the jump is not technical but organizational: security must stop asking "what model we use" and start mapping "what each actor (human or non-human) can achieve in my environment." This transition requires different tools, stricter identity policies and contracts that force suppliers to expose and control the agents they send within the platforms they manage.