Enterprises are handing agents customer interactions and internal workflows. New research suggests security teams are still working out who is accountable for what those agents can reach, and whether they can see and stop them in time.
A customer-facing website used to have a manageable cast: customers, benign bots and attackers. Now it has a fourth category, software that acts on behalf of a person and often does so legitimately. Inside the company, agents file tickets, query databases and call internal tools.
Both trends raise a question that security organizations have rarely had to ask about software: who is responsible for what it can access, and for what it does? The data coming out of this year's research raises questions about how clearly responsibility for agents has been assigned.
Agents are already at the front door
Arkose Labs'State of Agentic AI Trust Report for Q3 2026 puts numbers on the gap. Of the AI agent sessions the company classified as legitimate, 97.7% carried no verified disclosure of what the agent was or whom it represented. At the same time, 77.4% of AI agent sessions were classified as legitimate, compared with 7.9% of known bot sessions.
Read together, the figures suggest that blanket blocking could disrupt legitimate activity. They also show how little a business can verify about the agents it admits. Product, fraud and security teams have to settle who an agent represents, what it intends to do and what it is allowed to do, without adding friction for customers.
An earlier Arkose survey of 300 enterprise leaders, conducted in February, found that 97% expect a material AI-agent-driven security or fraud incident within 12 months. On average, 6% of security budgets go to AI-agent risk, and only 26% of respondents were very confident they could prove an agent caused an incident.
An attack surface that reads
Agents can be exposed to malicious instructions hidden in the content they process. Check Point Research'sAI Security Report 2026, published in July, says detections of longer malicious prompt-injection payloads rose roughly fivefold between March and May 2026, approaching 1% of observed prompts by May.
The report also describes how persistent such manipulation can be. A planted configuration file that an agent loads and trusts across sessions becomes what the researchers call a durable bypass, so a single poisoned input can outlast the conversation that delivered it.
Check Point also reports that high-risk prompts to generative AI tools doubled from 2% to 4% over the past year, and that organizations used an average of 10 AI applications a month, many without official approval. The prompt figure measures the potential for sensitive data to be exposed, not confirmed data loss. Business services had the highest rate, 5.91%, or roughly one in 17 AI interactions.
Data leaves through ordinary doors
Not every exposure involves an attacker. Much of it comes from employees using AI tools in the course of normal work. BlackFog, which sells anti data exfiltration technology, commissioned Sapio Research to survey employees in the United States and United Kingdom.
It found that 49% of employees use AI tools their employer has not sanctioned, only 53% understand how the data they enter is stored or analyzed, and 71% believe the productivity gains from unapproved tools outweigh the data risks.
Employee use of AI tools raises policy questions. Security teams need to decide which information may enter AI workflows at all, and how sensitive data is kept from leaving approved environments. A policy that employees see as an obstacle may be harder to follow, which is why data-handling rules have to fit everyday work and coordinate with the business owners deploying AI.
No identity, no accountability
Oversight also depends on being able to tell agents apart. A June research note from the Cloud Security Alliance, which describes itself as AI-assisted and not formally reviewed, pulls together vendor-sponsored surveys with differing methods, so its findings should be read with caution.
It reports that 43% of organizations rely on shared service accounts for agents and 31% let agents operate under a human user's identity. Some 52% say agents sometimes or often inherit access meant for humans or other systems and 68% cannot reliably tell agent activity from human activity in logs.
ForJai Dargan, CEO and Co-Founder ofHydden, the gap starts with visibility. “Everybody is building agents, and almost nobody is asking what identity each one has, who owns it, and what it can reach,” Dargan said. Employees may be able to create agents outside the view of security. Depending on their permissions, those agents may also be able to change their own access, he said. Existing identity tools were designed around HR events, he said: “An agent that lives for a minute does not show up to a quarterly review.”
This can complicate incident response. When an agent runs on a shared account or inherited permissions, an incident responder cannot easily establish who initiated an action. The note recommends giving each agent a distinct identity tied to a named owner and business purpose, using short-lived, narrowly scoped credentials, and keeping audit trails that show both the user and the acting agent.
Dargan frames the accountability problem plainly. “When an agent does something it shouldn’t, the first question is who created it and who authorized what it could reach, and most enterprises can’t answer either one,” he said. Authorship can be recorded at the moment of change, and keeping control can involve a continuous record of every identity, human, machine and agent, held outside the agent’s reach. “Only an append-only record outside the actor’s reach survives an actor that edits its own tracks.”
Assigning a team to oversee AI may be more effective if the team can establish which agents are operating, which permissions they hold and who answers for them.
A test for the security organization
Data from IANS and Artico Search's2026 State of the CISO Benchmark Report, drawn from 662 CISOs, was not about AI, but it describes the position they start from. Executive-level CISO titles are now the most common, yet 64% of CISOs still report to IT leadership.
IANS also released its Security Organizational Design report on October 20, examining team composition, reporting structures, leadership roles, compensation benchmarks and the use of external security providers. Those are among the variables that can influence where AI oversight can sit, how closely security works with the business units deploying agents, and when outside expertise is needed.
ForDaniel Shechter, CEO and Co-Founder ofMiggo Security, the challenge also involves how quickly those teams can act. “Security teams are behind, and it isn’t a talent problem, it’s a speed problem,” he said. “Defense still moves at the pace of tickets and patch cycles
An incident can provide a practical test. If an agent attempts an unsafe action, can the team accountable for AI risk see it, trace it to an identity and an owner, and contain it before damage spreads? The research suggests many organizations cannot yet answer yes to all three. Shechter argues that responding at that speed will require more automation in defense itself. “The next frontier is autonomous defense: closing exposure at machine speed, before an attacker can use it, without waiting on a patch,” he said. “The most effective defenses won’t just block autonomous attackers. They’ll make every attempt slower and costlier, until attacking you stops being worth it.” For now, the gap between how quickly agents are being adopted and how clearly responsibility has been assigned appears to be a recurring concern.
VentureBeat newsroom and editorial staff were not involved in the creation of this content.