One Rogue Employee-Built AI Agent Exposed Five Identity and Control Gaps
What happened
Token Security published How one AI agent exposed five critical enterprise security gaps. The case study shows how an accounts employee built an invoice-processing agent in roughly ten minutes, without security review. A Cloud Security Alliance survey of 418 IT and security professionals was commissioned by Token Security in January 2026. It found 68% of respondents believed they had strong visibility into their AI agents. Yet 82% had found agents they did not know about in the past year. The agent received access to email, an enterprise resource planning system, and Slack using a mix of delegated approvals and a personal, permanent API key with no expiry date. In week three, a malicious email with hidden text instructed the agent to change a vendor bank account in the ERP system; the agent complied without any human review. Detection only became possible when security practitioners baselining on what an agent actually does, rather than what permissions it holds, saw an action the agent had never taken before.
Why it matters
- ·Employees can build agents with broad system access using no-code tools in minutes. This bypasses formal procurement or security review and creates a shadow agent population existing inventories will not capture, as seen in 55% of Organizations Run System-Changing AI Agents Without Identity Controls.
- ·Prompt injection occurs when hidden instructions embedded in content an agent reads cause it to take unauthorized actions. The resulting log entries look legitimate, since the action uses a valid credential and an authorized tool. This makes conventional access-log review insufficient to detect compromise.
- ·Static, permanent API keys issued to agents by non-security staff create a standing privilege risk. A compromised key gives any attacker the full permissions of whoever created it, with no automatic expiry. The access path may also appear in logs under the human employee's identity rather than the agent's.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- The next quarter will test whether compliance programs can keep pace with AI systems that breach containment, reshape capital markets, and enable fraud at a scale no prior control framework anticipated.12 Nov
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Ask your IT and security team to run a discovery exercise for AI agents built or deployed outside formal procurement, specifically checking no-code platforms, ERP systems, email connectors, and messaging tools such as Slack.
- ☐Require that any agent connecting to systems holding financial data, personal data, or the ability to change records must go through a security review before going live, with a written record of who approved it and what access it was granted.
- ☐Audit all API keys currently assigned to AI agents and flag any that have no expiry date, broad permissions inherited from an individual employee's account, or no record of a formal access request.
- ☐Ask your security team whether agent monitoring compares agent actions against what the agent normally does, not just whether the action falls within the agent's permissions, since a manipulated agent can stay within its granted access the entire time.
- ☐Establish a policy requiring that agents which read external content, can see private or financial data, and can take actions without human review must be reviewed by security before launch, based on the three-question test described in the case study.
What to watch next
Self-reported agent visibility and actual agent discovery differ sharply. 68% claimed strong visibility while 82% found unknown agents. This signals that attestation-based compliance programs will not catch shadow agents built by business users. Regulators reviewing agentic AI risk are likely to focus on whether enterprises can demonstrate they know what agents exist and what access those agents hold. This includes the ICO's open probe into agentic AI data protection practices noted in ICO Secures Developer Changes and Opens Agentic AI Data Protection Probe. Compliance teams should monitor whether sector regulators, particularly in financial services and healthcare, begin requiring formal agent inventories as a supervisory expectation rather than a voluntary best practice.