[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5pmtCyhh3b4iLDOSr9b0i_6D1gEYXnamzIuMgzbOiRM":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":132},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"4e90f327-3088-4529-806b-1f6939c7dcd1","The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't","the-third-party-agent-problem-why-security-built-for-ai-you-chose-misses-the-age-6966a6","In environments studied for the 2026 State of Agent Security Report, roughly 1,280 third-party products now embed AI. About 282 of them sit behind single sign-on. The other thousand are invisible to identity infrastructure by default, not because anyone hid them, but because an identity stack can only govern what authenticates through it, and most agents never do. That gap is the clearest","A new report highlights that a significant number of third-party AI agents embedded in enterprise software are not visible to existing identity and security infrastructure. These 'inherited' agents, often bundled within existing applications, bypass traditional security review processes, creating a blind spot for organizations. The article emphasizes that security risks lie not in the AI models themselves, but in the scaffolding and ecosystem that grant these agents access and permissions.","Many third-party AI agents in enterprise software are invisible to security controls.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fthe-third-party-agent-problem-why.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEghemGbtxM2amUYAlxUPHPdMiyDMQJFWZeY-dDODRqCRD0phZXXQv0rrKHiOsLPW3t0Fq2XxvvFyCC-OmNs7TXhXXKSRVMPpC1GPKSUsyzN9t-W6L4jtiA2DUiTLgou4iyw0QXN-6Wfz0H2zWYGgC6-OxtlQrfb0PygOeBWwDnR11nl3Gl8W5pL07sExNc\u002Fs1600\u002Freco.gif","2026-10-10T11:00:00+00:00","2026-10-10T12:00:17.833435+00:00",7,[17,20,23],{"name":18,"type":19},"Slack Code","product",{"name":21,"type":22},"Salesforce","vendor",{"name":24,"type":25},"AI","technology","839da5c1-3c34-47e2-9499-f7201640e3ac",{"id":26,"icon":28,"name":29,"slug":30},null,"AI Security","ai-security",[32,37,42],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":26,"icon":28,"name":29,"slug":30},[],[21,18],{"controls":47,"vendors":131},[48,77,105],{"slug":49,"name":50,"problem":51,"products":52},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"slug":78,"name":79,"problem":80,"products":81},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":100,"url":103,"description":104},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":106,"name":107,"problem":108,"products":109},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[110,116,124],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":111,"product_name":112,"url":114,"description":115},"appomni","AppOmni","\u002Fvendor-logos\u002Fappomni.png","https:\u002F\u002Fappomni.com\u002F","SaaS security posture management for platforms such as Salesforce, Microsoft 365 and ServiceNow.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-shield","Falcon Shield","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Ffalcon-shield\u002F","SaaS security posture management, from CrowdStrike's acquisition of Adaptive Shield.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":126,"url":129,"description":130},"obsidian-security","Obsidian Security","\u002Fvendor-logos\u002Fobsidian-security.png","obsidian","https:\u002F\u002Fwww.obsidiansecurity.com\u002F","SaaS posture management and detection of account and integration compromise.",[],{"slug":133,"title":134,"body":135,"framework_refs":136,"framework_notes":151},"inherited-ai-agents-create-hidden-identity-and-access-blind-spots","Inherited AI Agents Create Hidden Identity and Access Blind Spots","Organizations are unknowingly inheriting third-party AI agents bundled within enterprise software, bypassing standard security review and identity governance processes. The core risk is not the AI models themselves but the permissions and access scaffolding granted to these agents without explicit authorization or oversight. Because these agents are embedded rather than deliberately deployed, they fall outside existing security tooling designed for known, chosen software. This creates a significant blind spot where agents may hold excessive permissions, interact with sensitive data, and operate entirely unmonitored. If left unaddressed, organizations lose visibility and control over a growing attack surface introduced through trusted software vendors.",[137,138,139,140,141,142,143,144,145,146,147,148,149,150],"CIS Control 1 – Inventory and Control of Enterprise Assets","CIS Control 5 – Account Management (Non-Human Identities)","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 CA-3 – Information Exchange","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST AI RMF – Govern 1.1, Map 1.5 (Third-Party AI Risk)","NIST SP 800-161 – Supply Chain Risk Management","GDPR Article 28 – Processor Obligations (Third-Party Data Access)","GDPR Article 32 – Security of Processing","ISO 27001 A.8.3 – Information Access Restriction","ISO 27001 A.15 – Supplier Relationships",{}]