How one AI agent exposed five critical enterprise security gaps

Token Security released new findings and educational resources through its Agentic Universe learning hub, gathering operational guidance from more than twenty cybersecurity practitioners at firms including Roblox, Klaviyo, and Webflow. As detailed in BleepingComputer's report, an industry survey of 418 IT and security professionals conducted with the Cloud Security Alliance in January 2026 revealed that while 68 percent claimed strong visibility into enterprise agents, 82 percent discovered unmanaged autonomous tools operating inside their corporate networks over the past year.

This analysis examines five distinct failure points uncovered when an invoice automation agent built by an accounting employee altered financial records without triggering alerts. It outlines practical defensive controls, governance tests, and architecture rules for security teams, enterprise architects, and identity administrators charged with safeguarding corporate data against autonomous system risks.

01Four access paths and credential chains

Enterprise agents typically obtain system access across four channels defined by John Donovan, former Head of Security, IT and Compliance at Zededa. These avenues include riding human browser sessions, delegated OAuth grants, static API credentials, and dedicated agent identities. The majority of self-configured automation workflows combine several of these methods across multi-tiered workflows.

When an agent passes an OAuth token to a sub-agent that triggers a model context protocol server querying a database through a shared service account, visibility fragments completely. Database logs record only the service account identity, while SaaS application audit trails capture the original user. Identity providers fail to register the interaction entirely, obscuring the actual execution chain.

Static API keys generated by non-technical creators often carry broad administrative permissions matching the employee's personal role. Because third-party OAuth approvals do not automatically expire when staff change internal roles or leave an organization, these unmanaged access grants persist silently within cloud environments for months without administrative discovery.

02The Agents Rule of Two review

Unmonitored agent deployments frequently skip security reviews because creators build them independently using frontier models in ten minutes. To establish baseline defenses, DataRobot Product Leader for AI and Cybersecurity Amber Bennoui expanded the Agents Rule of Two framework originally published by Meta's AI security team in October 2025.

Under this architectural design standard, an autonomous agent session must never combine more than two high-risk capabilities simultaneously until prompt injection can be reliably prevented. These conditions comprise processing untrusted external input, accessing sensitive enterprise systems or private data stores, and executing state-changing transactions or outward external communications.

Accounting agents that ingest arbitrary emails, inspect confidential ERP ledgers, and hold write permissions to alter vendor records violate all three boundaries. Bennoui recommends requiring builders to answer three explicit screening questions regarding untrusted ingestion, private data access, and autonomous actions before deploying any automated assistant to production environments.

03Hidden prompt injection in invoice attachments

Operational risks materialize when automated assistants ingest unvetted files that manipulate underlying model reasoning. In a documented scenario, an attacker sent a routine billing notice containing hidden white text on a white background requesting an immediate banking update. The processing agent parsed the concealed text and executed the modification inside the company ERP.

Cybersecurity researcher and CISO Joshua Copeland emphasized that input streams must be treated as execution orders capable of hijacking autonomous tools. Unlike malicious software exploits, injected instructions execute through authorized system tools and valid user credentials, producing standard logs that appear entirely benign to traditional perimeter monitoring platforms.

Copeland noted that compromised agent credentials present greater enterprise hazards than transient agent hijackings. When builders embed personal API keys without expiration dates into no-code automation platforms, adversaries who extract those secrets obtain persistent, unmonitored access to sensitive back-office systems that survives individual task restarts.

04Behavioral baselining and anomaly detection signals

Detecting compromised agents requires monitoring execution patterns rather than evaluating permission boundaries. Benchling CISO and CIO Chad Kalmes warned that baseline permission checks fail because hijacked models remain strictly inside their authorized access scopes while performing malicious tasks. Instead, detection platforms must evaluate real historical activities over trusted operational intervals.

Two specific behavioral deviations exposed the invoice tampering incident in Benchling's analytical framework. The agent triggered a write transaction after three continuous weeks of read-only operations, and it executed an unprecedented operational sequence by altering vendor disbursement accounts immediately after ingesting an external email.

Kalmes highlighted that identical behavioral alerts identify both compromised agents manipulated by external adversaries and rogue agents that malfunction while attempting legitimate workflows. When suspicious actions emerge, incident response teams should suspend agent execution and revoke credentials while preserving active memory transcripts to facilitate forensic review.

05Historical audit trails and human delegation

Auditors examining autonomous actions two months after an incident evaluate four mandatory compliance criteria: the specific agent identity, the active entitlement, the approving party, and the authorizing human. Simeio Senior Director of Identity Security Services Rajesh Seshadri Appikulam highlighted that authority cannot be reconstructed retrospectively if logging omitted delegation paths.

In the accounting incident, ERP transaction ledgers recorded only the employee personal API key, creating false attribution that implicated the human builder. Although security engineers revoked the key during incident cleanup, the transferred employee's delegated OAuth inbox grant remained active, leaving residual administrative exposure across the enterprise email system.

Appikulam introduced a ten-question governance diagnostic that organizations can complete in five minutes. Security teams should determine whether they can identify the authorizing human for any sixty-day-old automated action, and verify that every production agent currently operating across the enterprise has a documented, active business owner.