An analysis published by The Hacker News argues that most enterprise AI security is aimed at the wrong target. The piece, contributed by a partner and containing promotional material, says controls built for AI a company deliberately adopted miss the agents that arrive inside software it already runs. It is an opinion article. It does not describe a breach, a vulnerability or an enforcement action.
Three ways an agent enters the company
The author sorts agents by how they arrive:
- Inherited: shipped inside an existing platform through a routine product update.
- Configured: built from the enterprise's own prompts and logic, but running on a vendor's runtime, model and connectors.
- Built: assembled from open frameworks on infrastructure the enterprise owns.
According to the author, the first two make up the "overwhelming majority" of adoption and are growing "exponentially." Built agents are described as the smallest and slowest-growing group. The piece offers no measurement behind these characterizations.
The consequence, in the author's telling, is that no one decides to adopt an inherited agent. It appears with an update, so the review that normally precedes a new AI deployment never takes place.
A figure from an unnamed report
The article cites the "2026 State of Agent Security Report," which it does not tie to a publisher or describe in terms of method or sample. Per that report, about 1,280 third-party products in the studied environments embed AI. Roughly 282 of them sit behind single sign-on.
The author reads the gap as leaving "the other thousand" invisible to identity infrastructure by default. These are counts of products, not of agents or people. The article's other scale examples, such as fifty, five hundred and five thousand agents, are illustrations rather than data.
The Slack Code example
The author's main case study is Slack Code, which the article says Salesforce launched in August 2026. A user tags the coding agent into a conversation. It reads the shared context, writes code and opens pull requests, with reach into GitHub and production infrastructure, according to the article.
Salesforce's announcement, as quoted in the piece, says agents "inherit Slack's built-in security model, permissions, and admin controls from day one, without any additional IT lift." The article sets that promise against the agent's wider reach beyond Slack itself.
Where the author locates the risk
The piece holds that risk sits mainly in an agent's scaffolding and surrounding ecosystem, not in the underlying model. It proposes four areas for review:
- Identity: which agent is acting, and on whose behalf.
- Permissions: what it is entitled to do.
- Connectivity: the blast radius, including what it can reach indirectly through other systems.
- Activity: a judgment based on observed behavior, not declared intent.
Opet and the EU AI Act
The author invokes Patrick Opet, global CISO of JPMorgan Chase. In 2025, the article says, Opet described the third-party supply chain as a systemic risk. It adds that incidents were serious enough for the bank to isolate compromised suppliers, a point made through an open letter. The article gives no details of those incidents.
The author also attributes to Opet the position that an agent should get an identity but no entitlements by default. Before it touches anything outside its boundary, IT should confirm whom it acts for.
On regulation, the author says the EU AI Act, whose obligations apply in phases through 2026, assumes enterprises can inventory their AI systems, name owners and evidence oversight. That is difficult, the piece argues, when agents arrive unannounced inside vendor products.
The vendor angle
The article names Reco, and its Reco Graph platform, as a "leading example" of a tool that links human and non-human identities, applications, permissions and agent actions into a live view. The piece is partner-sourced, so that endorsement is the contributor's advocacy. Reco's agent discovery is referenced at reco.ai/platform.
For security teams, the practical takeaway is narrower than the sales pitch. The argument is that an inventory of agents should start from the SaaS applications already in use, not from a list of approved AI projects.
