Security teams are realizing that Zero Trust for AI agents cannot be enforced without first seeing what agents exist and what they can reach. Recent incidents, including one at METR where an attacker exploited an invisible agent to steal API keys and burn $600,000 in tokens, highlight the danger of deploying agents without visibility. The article argues that jumping straight to enforcement controls is premature when no inventory exists.
A key challenge is that agent use has become a new form of shadow IT. Many employees build autonomous workflows without IT's knowledge, and blocking tools before discovery risks shutting down legitimate use. The article cites research showing 70% of organizations admit AI workflows already contact sensitive data without full oversight, and 67% say IT cannot fully track these workflows.
Another obstacle is that no single monitoring tool captures the full picture. Agents operate across networks, endpoints, browsers, and SaaS platforms, with encrypted traffic hiding prompts and tool calls. The article advises correlating multiple telemetry sources—such as DNS logs, endpoint process data, and API key usage—to build a composite view. The operating principle is clear: know first, then restrict, rather than attempt to govern what you cannot see.