Enterprises are discovering a new blind spot: inherited AI agents operating inside platforms like Salesforce and ServiceNow can subvert governance without any misconfiguration. These agents follow prebuilt paths—like Email-to-Case workflows that convert customer emails into case records, then feed them into automated agent prompts—which enable unauthenticated outsiders to interact with internal agent logic and observe replies without touching the model itself. This isn’t a hack; it’s behavior baked in by design.
The Achilles’ heel: the application, not the AI
While attention often focuses on securing large language models (LLMs) or prompt design, real threats emerge from platform features and configurations. Tools like Email-to-Case, Web-to-Case, guest-user exposures, and automation untrusted intake (for example, guest users initiating case creation) can let outside inputs slip into agent prompts. Prompt filters don’t always detect how an input starts, meaning malicious content can pass through undetected.
Recent enterprise risk research—especially Reco.ai’s City-Forum campaign—traced data theft operations lasting over a year that leveraged precisely these exposure paths. It highlights how governed features often harbor inherited agents nobody explicitly reviewed or approved.
Scaling threats: builder explosion and shadow agents
Agents are proliferating far beyond the control of central governance. Different teams—marketing, finance, operations—are creating agents for distinct tasks. Some agents spin up sub-agents, each with overlapping access. The result: a web of agents carrying inherited permissions, many of which were never subject to risk review. Reco calls this “shadow agents.”
Any governance framework assuming that every agent was explicitly created by a human is now obsolete. With agents building agents through orchestration platforms or dev pipelines, ownership, access, and identity management become muddled.
Why policies alone don’t work
Most organizations have agent-governance on paper: policies, principle statements, committees. But when asked operational questions—how many agents are active, who owns them, what data they touch—they find huge gaps. They can’t map risk because they can’t even see the scale of what they’re governing.
The OWASP Agentic Skills Top 10 taxonomy spotlighted this gap under its “No Governance” category (AST09): agents deployed inside third-party platforms are invisible to external tools. The risk is not abstract—it’s already exploited.
A bottom-up governance stack—and tests you can run now
To fix this, enterprises need layered checks:
- Discovery:continuously inventory agents across application configurations, network metadata, email systems. Operational test: the discovered agent count should dwarf the internal list.
- Posture:understand which features are exposed (like guest-user access), which automations trigger agents, how intake is handled.
- Identity & ownership:each agent needs a human owner and lifecycle management. Operational check: ask “who owns this agent?” and expect a person to claim it within a day.
- Usage visibility:who is calling what agent, using what data, via which interface. Policies must match observed usage.
- Agent controls:enforce least-privilege, quarantine new agents, risk-tier according to context. Enforce via automated workflows.
- Runtime monitoring:live inspection and intervention of agent behavior—detecting abnormal actions and cutting off dangerous flows.
The EU AI Act is looming. It carries fines on par with GDPR—up to €35M or 7% of global turnover for prohibited practices—and expects evidence of operational compliance, not just documents. Enterprises still relying on paper compliance risk having nothing to show when regulators ask.
Reco is already offering platforms that discover agents, assess risk contextually, map ownership, and generate real-time governance metrics. These tools are turning policy into action.
Analytical Take: This isn’t just another AI security checklist—it’s a wakeup call. Inherited agents exploit the fact that many governance regimes focused on centralized models or policies, not the living systems enterprises use. What matters now isn’t just what’s written in policy, but whether security teams can see, own, and control every agent. The coming months will split organizations that merely comply from those that actually secure agent-first workflows.
