Executive Summary
The 2026 State of Agent Security Report found about 1,280 third-party products embedding AI in studied environments; only about 282 sit behind single sign-on, leaving the rest invisible to identity infrastructure.
What Happened
In environments studied for the 2026 State of Agent Security Report, roughly 1,280 third-party products now embed AI. About 282 of them sit behind single sign-on. The other thousand are invisible to identity infrastructure by default, not because anyone hid them, but because an identity stack can only govern what authenticates through it, and most agents never do. That gap is the clearest
Vulnerability / Attack Technique
Ungoverned third-party AI agents outside identity controls
Technical Mechanism
Identity stacks can only govern agents that authenticate through them; most embedded third-party agents never do, so they are not seen or controlled.
AI Security Category
LLM06:2025 Excessive Agency
Part of the AI Agent Excessive Agency topic.
Relevant Frameworks
RealGround Analysis
Security programs built for the AI an organization chose miss the agents its vendors shipped. RealGround analysis: an AI inventory has to include third-party products with embedded agents, not only internal builds.
Recommended Controls
- Inventory third-party products with embedded AI agents
- Require vendors to disclose what data and actions their agents can access
- Bring agent-capable SaaS behind SSO where possible
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/10/the-third-party-agent-problem-why.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.