Third-Party AI Agents Slip Past Identity Systems, Report Finds

The 2026 State of Agent Security Report, cited by The Hacker News, reveals a widening gap in how modern identity infrastructure handles third‑party AI agents. While organisations increasingly rely on single sign‑on (SSO) to streamline access, many AI‑enabled tools are bypassing these controls entirely.

The research examined roughly 1,280 third‑party products that now embed artificial intelligence. Of those, only 282 are managed through SSO, leaving the remaining thousand invisible to the identity stack by default. This is not a result of deliberate concealment but a limitation of current authentication models, which can only govern agents that actively authenticate through them.

Identity stacks are designed to enforce policies on entities that present credentials. Most AI agents, however, operate as background services or integrate via APIs that do not trigger standard authentication flows, meaning they fall outside the reach of traditional access‑management tools. Consequently, they can communicate with corporate resources without being logged or monitored.

For Australian businesses, especially those in regulated sectors such as finance and government, the blind spot poses a compliance risk under frameworks like the Australian Privacy Principles and the Notifiable Data Breaches scheme. Companies in Darwin and across the country are urged to reassess their identity governance strategies, incorporating behavioural analytics and zero‑trust principles to detect and control unauthenticated agents.

Addressing this challenge will require up‑skilling IT staff on modern identity and access management practices. Training providers such as Wepro Technology offer courses—including CompTIA Security+ and specialised identity‑management modules—to help professionals design and implement controls that can surface hidden AI agents and protect critical infrastructure.