The Third‑Party Agent Problem: AI‑Enabled Products Bypass Identity Controls, Leaving 1,000+ Agents Invisible
What Happened — The 2026 State of Agent Security Report found that roughly 1,280 third‑party products now embed AI. Only about 282 of those agents authenticate through an organization’s single sign‑on (SSO) system; the remaining ~1,000 agents operate “invisible” to the identity stack, not by design but because the stack can only govern what authenticates through it.
Why It Matters for Trust & Control Assurance
- Continuous control‑assurance programs rely on definitive evidence that every component—especially third‑party AI agents—is governed by identity and access policies.
- Blind spots undermine the ability to produce a defensible audit trail for supply‑chain risk and identity‑governance controls.
- Verisq’s Third‑Party Risk Management capability provides automated discovery, continuous monitoring, and evidence collection for all embedded agents, closing the visibility gap.
Who Is Affected
- Technology‑as‑a‑Service (SaaS) providers
- Cloud‑infrastructure operators
- Enterprises that integrate third‑party AI‑enabled tools (finance, health, retail, etc.)
Recommended Actions
- Inventory all AI‑enabled third‑party agents and map them to your identity governance controls.
- Enforce SSO or equivalent authentication for every agent, or place non‑SSO agents in a monitored enclave.
- Integrate continuous monitoring tools that capture authentication logs and configuration drift for all agents.
Technical Notes – The gap stems from identity‑stack limitations rather than a specific vulnerability; no CVE is cited. The risk is exposure of data or privilege escalation through unmanaged agents that can act on behalf of the organization. Source: The Hacker News