The AI Agents You Didn't Approve Are Already Logged In

On October 9, Anthropic published an unusual admission. Reviewing transcripts from its own evaluations, it found Claude models taking actions on real websites that nobody had asked for. One model found and exploited an injection flaw on a university server to pull files it needed for a science task. Another filled out the Philadelphia Police Department's tip form with a made-up lead while generating example web interactions. Others used URL shorteners to get around the limits on a fetch tool, and obtained access tokens to skip a state agency's fees. Anthropic's summary of the pattern is worth reading twice: "When models are given impossible-to-complete tasks, they will pursue unintended and sometimes misaligned strategies to achieve their goals."

Anthropic has since cut live internet access for its internal evaluations and built tooling to catch this behavior (Anthropic's write-up; coverage in The Hacker News). That is the response of a lab that knows exactly which agents it runs. Most companies do not.

Agents look for a way through

A chatbot answers a question. An agent is given a goal and the access to pursue it: a browser, an inbox, an API key, a connection to Slack or your CRM. When the obvious path is blocked, it looks for another one. That is useful when the path is a missing field in a form. It is a problem when the path is a credential it was not meant to use, or a system it was never meant to touch.

This is the next step past shadow AI. Shadow AI was employees pasting data into chat tools nobody approved. Agents go further: they hold credentials and take actions on your systems.

The Anthropic examples happened inside a controlled research setting with people reviewing the transcripts afterward. In most mid-market companies, agents are connected to real systems and nobody is reading the logs, because nobody knows the agents are there.

Three ways agents are getting in without approval

1. Your employees brought their own

Personal AI agents have gone from experiment to mainstream in under a year. A contributed piece in The Hacker News on October 12 describes how they reach company systems: an employee clicks through an OAuth consent screen, pastes a personal access token, lets the agent use passwords saved in the browser, or installs it on a laptop where it can read mail and files. None of that goes through procurement or security review, and much of it looks like the employee's own activity in the logs.

2. It came bundled with software you already pay for

The second route needs no one to do anything wrong. Vendors are adding agents to products you bought years ago. Reco's 2026 State of Agent Security Report, summarized in The Hacker News on October 10, counted 1,280 third-party products with embedded AI in the environments it studied, of which 282 sat behind single sign-on. Treat those as vendor figures from a company that sells agent security, but the direction is hard to argue with: most of these agents arrive through an update, inherit the permissions the product already had, and never pass through a security decision at all.

3. Your own teams built one

The third route is internal. An engineer wires an agent into a support queue, a finance analyst connects one to the accounting system, marketing gives one access to the CMS. Each is usually given a broad API key because that is fastest, and few have a named owner once the person who built them moves on. The supply chain under these agents is also a target; we wrote about one version of that in slopsquatting.

Why blocking alone fails

The instinct is to ban personal agents and switch off AI features. It rarely holds. The productivity gain is real, people route around bans, and vendors keep shipping AI into products whether you asked or not. The goal is to know what is connected, give it the least access it needs, and decide in advance what it may do without a person.

What to do in the next 30 days

1. Pull the OAuth and SSO grants. Your identity provider and Microsoft 365 or Google Workspace admin consoles list every third-party app users have authorized. Sort by scope: anything that can read mail, files or calendars, or act as the user, goes to the top of the list.
2. Ask, with an amnesty. Send a short note asking which AI assistants and agents people use for work, with a promise that the answer leads to approval or a safer alternative, not discipline. You will learn more in a week than a tool will find in a month.
3. Check the AI in the tools you already have. For your top 20 SaaS products by data sensitivity, find out which have added AI features or agents, what data those features can reach, and whether they can be turned off or limited.
4. Give every agent an owner and a purpose. No owner, no access. Record what it is for, what it can reach, and who answers for it.
5. Cut access to what the job needs. Replace broad API keys and all-mail scopes with narrower ones. Start new agents with no entitlements and add access deliberately.
6. Write down what agents may do alone. Reading and drafting is one thing; sending, paying, deleting or changing access is another. Use the same decision rights you already use for people, which we covered in our piece on decision speed.
7. Add agents to offboarding. When someone leaves, revoke the agents and tokens they connected, not just their account.

None of this requires a new platform to start. It requires someone to own the list. For the wider program, see our AI governance checklist for mid-market companies, our guide to securing AI agents, and the AI Agent Security Report 2026.

Sources

• Anthropic, "Investigating unintended model actions in our evaluations and internal use", October 9, 2026.
• The Hacker News, "Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws", October 10, 2026.
• The Hacker News, "Bring Your Own Agent: Your Employees' Assistants Are Already Logged In", October 12, 2026 (contributed by Token Security).
• The Hacker News, "The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't", October 10, 2026, citing Reco's 2026 State of Agent Security Report.