The third-party agent problem: why security built for your chosen AI misses the agents you didn't choose

The 2026 State of Agent Security Report studied approximately 1,280 third-party products that have embedded AI, of which about 282 use single sign-on, while the remaining roughly one thousand are invisible to identity infrastructure by default. The article points out that agents are mostly "inherited" through updates to existing platforms, rather than proactively purchased by enterprises, so first-party controls such as model scanning and prompt checking are ineffective; the risk lies mainly not in the model itself, but in its scaffolding and ecosystem. JPMorgan Chase's global CISO Patrick Opet argues that agents should by default have only an identity and no permissions, and the obligations under the EU AI Act taking effect in phases in 2026 also require enterprises to be able to inventory their AI systems.