2026 Report Reveals Most Third-Party AI Agents Bypass Identity Controls
A new security report finds that roughly 1,280 third-party products embed AI, but only 282 are visible to single sign-on systems, leaving the majority unmanaged.
Key points
- The 2026 State of Agent Security Report identifies a significant gap in identity infrastructure for third-party AI tools.
- Approximately 1,280 third-party products embed AI, yet only 282 sit behind single sign-on protocols.
- The remaining agents are invisible to identity infrastructure by default because they do not authenticate through it.
According to The Hacker News, the 2026 State of Agent Security Report highlights a critical blind spot in enterprise security regarding third-party AI integration. The analysis reveals that while organizations are increasingly adopting AI tools, the majority of these agents operate outside the scope of standard identity and access management controls. This structural gap leaves enterprises exposed to risks they cannot monitor or govern through existing security stacks, creating a pervasive vulnerability across digital environments.
The report provides specific data on the scale of this exposure within studied environments. Roughly 1,280 third-party products now embed artificial intelligence capabilities into their workflows. However, only about 282 of these tools are configured to sit behind single sign-on systems. This small fraction represents the only segment of the AI agent landscape that is visible and controllable through standard identity infrastructure, while the vast remainder operates in a security vacuum.
The Mechanics of Invisible Agents
The invisibility of these agents is not the result of malicious concealment by vendors or users. According to the report published by The Hacker News, the issue stems from the fundamental limitations of current identity stacks. These systems can only govern entities that explicitly authenticate through them. Most third-party AI agents never undergo this authentication process, meaning they are effectively invisible to the identity infrastructure by default. This architectural mismatch creates a clear and dangerous gap in security coverage that extends beyond simple oversight or misconfiguration.
This phenomenon is described as the "Third-Party Agent Problem" in the report. Security measures designed for chosen AI tools often fail to address agents that organizations did not explicitly select or integrate into their identity workflows. Because these agents do not pass through single sign-on gateways, they bypass logging, monitoring, and access controls that would otherwise apply to standard enterprise applications.
Scope of the Exposure
The exposure affects a wide range of third-party products that have integrated AI features. The 1,280 products identified in the study represent a significant portion of the modern software supply chain. Security professionals must recognize that the presence of AI in a tool does not guarantee its visibility to security operations. The default state for most of these agents is obscurity within the network, as they lack the necessary authentication hooks to be recognized by identity providers.
This lack of visibility means that security teams cannot apply consistent policies to these agents. Without single sign-on integration, there is no central point to enforce least privilege access or to detect anomalous behavior associated with these AI-driven tools. The report underscores that the current identity infrastructure is ill-equipped to handle the volume and variety of third-party AI agents currently in use.
What should you do?
Security teams should audit their environments to identify which third-party AI products are in use and whether they integrate with single sign-on systems. Organizations need to verify that any AI tool with access to sensitive data is subject to identity management controls. Monitoring network traffic for unauthenticated AI agent activity can help detect tools that are operating outside of established security boundaries.
What to do and how to stay safe: AI security
- Inventory all third-party software in your environment to determine which products embed AI capabilities and assess their current integration status.
- Verify that every third-party AI tool requiring access to enterprise data is configured to use single sign-on for authentication and visibility.
- Review identity stack logs for gaps in coverage, specifically looking for applications or agents that operate without passing through authentication protocols.
- Establish a policy requiring that any new third-party AI product must demonstrate compatibility with existing identity infrastructure before deployment.
Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many third-party products with AI are invisible to identity infrastructure?
According to the 2026 State of Agent Security Report, roughly 1,280 third-party products embed AI, but only 282 are behind single sign-on, leaving the majority invisible.
Why are these AI agents invisible to security teams?
They are invisible because most agents never authenticate through the identity stack, and the infrastructure can only govern what authenticates through it.
Is this invisibility due to intentional hiding by vendors?
No, the report states that these agents are invisible by default because identity stacks cannot govern them, not because anyone intentionally hid them.
