How one AI agent exposed five critical enterprise security gaps

one disclosed that a credential was leaked, exposing a trust relationship that could have been abused.

This one is built by someone in accounts at a mid-sized company.

The agent’s job is relatively simple: read an inbox, match invoices against the ERP, and post a daily summary to Slack.

In a survey of 418 IT and security professionals commissioned by Token from the Cloud Security Alliance in January 2026, 68% reported having strong visibility into their AI agents.

Yet 82% had found agents they didn't know about in the past year.

Also, be mindful of OAuth grants, as they don’t usually get revoked by the IdP and can remain active long after the person who approved them changes jobs.

Anyone connected to one through the compromised trust relationship is potentially affected, not just one itself.

The people responsible for agent security need to figure things out in production, one problem at a time.

Our agent needs access to three systems: email, the ERP, and Slack.

A leaked key doesn't need an exploit to be dangerous -- it just needs to still work before someone notices and revokes it.

Below, we follow this one agent from the afternoon it was built to the audit after it went wrong, and stop at five points where one of those practitioners could have changed the outcome.

The agent’s creator can generate a personal API key in minutes by following the AI's very helpful instructions.

The trust mechanism involved here is an API or master key, which is what let access move between otherwise unrelated systems.

The evolution of agents is so rapid that the security playbooks are being written on the go.

At Token Security, we asked more than 20 of them to write down what they've learned for the Agentic Universe, a free learning hub.

one says the credential has been revoked, and no exploitation has been confirmed so far.

Ideally, Bennoui says, you make the safe path the default, then ask builders to answer three plain questions: does your agent read anything from outside the company, can it see private data, and can it act without a person checking first?

Inside the attachment, in white text on a white background, is a note requesting an update to the ERP as the vendor changed its bank.

If you have any integration or dependency involving one, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.

Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.

Until prompt injection can be reliably detected and refused, an agent should have no more than two of these in a single session: Our agent has all three.