Imagine an AI agent being created. Not by an identity team, nor by a security professional. This one is built by someone in accounts at a mid-sized company.

The agent’s job is relatively simple: read an inbox, match invoices against the ERP, and post a daily summary to Slack. And since a frontier model was used to build it, it's a one-shot, 10-minute task.

Nobody in security knows the agent exists.

There's nothing unusual about this. In a survey of 418 IT and security professionals commissioned by Token from the Cloud Security Alliance in January 2026, 68% reported having strong visibility into their AI agents. Yet 82% had found agents they didn't know about in the past year.

The evolution of agents is so rapid that the security playbooks are being written on the go. The people responsible for agent security need to figure things out in production, one problem at a time.

At Token Security, we asked more than 20 of them to write down what they've learned for the Agentic Universe, a free learning hub.

Below, we follow this one agent from the afternoon it was built to the audit after it went wrong, and stop at five points where one of those practitioners could have changed the outcome.

Day One: How the agent got its access

Our agent needs access to three systems: email, the ERP, and Slack. It gets emails via the no-code builder, using an OAuth consent screen. The ERP is trickier, but not by much. The agent’s creator can generate a personal API key in minutes by following the AI's very helpful instructions. Slack comes in through the builder's own Slack connector, with one more consent screen.

That's two of the four access paths John Donovan, former Head of Security, IT and Compliance at Zededa, lays out in How do AI agents access sensitive systems and data?:

• Riding a human's session: Browser extensions and in-app copilots that act as the user.
• Using a delegated OAuth grant: The user approves scopes once, with a single click, granting the agent access that lasts until someone revokes it.
• Utilizing static credentials: API keys and service account passwords, usable by anyone who finds them.
• Acting through purpose-built agent identities: Registered, short-lived, and tied to one agent. The ideal and rarest scenario.

Donovan's point is that real agents mix these, and each mix changes what you can see. Say an agent hands a user's OAuth token to a sub-agent, which calls an MCP server that queries a database with a shared service account.

The database log shows the service account. The SaaS audit log shows the user. The identity provider shows nothing at all.

The access path determines what appears in your logs, so ideally you’ll understand it for each agent in the company. Also, be mindful of OAuth grants, as they don’t usually get revoked by the IdP and can remain active long after the person who approved them changes jobs.

Day Two: The review that never happened

The agent goes live the next morning. Nobody reviews it because nobody was asked to.

Had someone looked, one test would have flagged it. In How do you make an AI agent Secure by Design?, Amber Bennoui, Product Leader for AI and Cybersecurity at DataRobot, builds on the Agents Rule of Two, which Meta's AI security team published in October 2025.

Until prompt injection can be reliably detected and refused, an agent should have no more than two of these in a single session:

• A: It processes untrusted input.
• B: It can reach sensitive systems or private data.
• C: It can change state or communicate externally.

Our agent has all three. It reads email from anyone who knows the address, it sees vendor bank details in the ERP, and the personal API key it runs on can do anything its creator can do in the ERP, including editing those bank details.

Ideally, Bennoui says, you make the safe path the default, then ask builders to answer three plain questions: does your agent read anything from outside the company, can it see private data, and can it act without a person checking first?

Anyone who answers yes to all three has to talk to security before switching the agent on.

Week Three: The malicious email no one opens

The Slack summaries are genuinely useful, and the agent owner is satisfied. They’re thinking about what else can be automated with agents. Just then, an invoice lands in the inbox from the address of a known vendor. Inside the attachment, in white text on a white background, is a note requesting an update to the ERP as the vendor changed its bank.

No person reads that email, but the agent does, including the hidden text, and it makes the change.

In How are AI agents compromised?, a five-minute video, Joshua Copeland, a CISO and cybersecurity researcher, shows how instructions can get into an agent. Some arrive directly from whoever can talk to it. Others ride in on the content it reads, including an email nobody opened.

Either way, the result looks clean in your logs: an authorized tool, a valid credential, permitted work.

Copeland also explains why stealing an agent's credentials can be worse than compromising the agent itself. For this agent, that's the personal ERP key from day one, saved in the builder with no expiry date.

Ideally, you treat every input an agent reads as something that can issue orders to it. Then you make sure no single input can lead to an action you can't undo.

That Thursday: Catching it

The bank change goes through on a Thursday. Whether anyone notices depends on what your detection compares the agent against.

If it compares the agent against its permissions, nothing fires. In The Compromised and Rogue Agent Detection Checklist, Chad Kalmes, CISO and CIO at Benchling, warns against that baseline, because a misbehaving agent can stay inside its grants the whole time.

He baselines on what the agent actually does over a window you can trust, such as the tools it calls and the places it sends data.

Against that baseline, two of his signals fire here:

• First use of a tool, even a permitted one. For three weeks, the agent has only read from the ERP. The bank change is its first write.
• A new sequence. Reading an email and then changing a payment record is an order of operations the agent has never run.

Kalmes distinguishes a compromised agent, which follows an attacker's instructions, from a rogue one, which causes damage while following legitimate instructions. The signals mostly overlap.

When you act, suspend the agent without destroying it. Revoke the credential, but keep its memory and transcripts. The poisoned invoice may still be in there.

Day Sixty: Who approved this?

Two months later, the auditors pull the bank change from the agent's history and ask who approved it.

In What audit evidence do you need for AI agents?, Rajesh Seshadri Appikulam, Senior Director of Identity Security Services at Simeio, lists the four questions an auditor asks about an agent's action: which agent did it, under what entitlement, with whose approval, and on whose authority.

The first is easy. The last is the hard one, because authority can't be rebuilt after the fact.

Unless the human behind the request and the delegation chain were recorded at the time of the action, they're gone.

For our agent, the record is thin. The ERP log shows the creator's personal API key, so the bank change appears to be their doing. The response team revoked that key, but the agent owner moved to another team last month, and their OAuth grant to the inbox is still live.

Appikulam closes with a ten-question test. Each should take under five minutes. Start with two:

• Pick any agent action from 60 days ago. Can you name the human it acted for?
• For any agent in production, can you name its owner today?

If either takes longer than five minutes, you know where to start.

One agent out of hundreds

The agent we followed is imaginary, but agents like it aren't. As we've mentioned at the beginning, 82% of respondents in the CSA survey had found ones they didn't know about. Each fix above came from someone who first encountered the problem in production and wrote down a solution.

The Agentic Universe holds the rest of what they wrote.

More than 20 contributors, including security leaders at Roblox, Klaviyo, and Webflow, cover the field from how agents work to how you respond when one goes wrong, in formats from short videos to checklists you can run against your own environment. It's free and ungated.

Explore the Agentic Universe

Sponsored and written by Token Security.