A new security analysis published by SANS Institute reveals that seven in ten organizations now allow AI workflows to interact with sensitive corporate information without complete supervision. The cheat sheet, titled "Zero Trust for AI Agents: The Security Checklist," argues that companies are racing to deploy autonomous agents faster than they can track or protect them, creating blind spots that attackers can exploit. Written by security expert Ismael Valenzuela, the report positions visibility as the essential first step before any governance controls can work.
The report cites research from Veeam showing that 70% of organizations admit AI workflows already touch sensitive corporate data without full oversight, while 67% say IT departments can't fully track the autonomous workflows employees are building. The analysis highlights a recent incident at METR, a nonprofit that evaluates AI security, where an attacker found an employee's personal cloud instance running an agentic application, bypassed authentication, and prompted the agent to surrender its model provider API key. Over three weeks, the intruder consumed the equivalent of $600,000 in tokens because the API key had no spending limit and METR's internal dashboard didn't display data on rate-limited requests.
According to the SANS cheat sheet, "you cannot govern what you cannot see" sits at the foundation of Zero Trust principles for AI agents. The report emphasizes that inventory must come ahead of every enforcement control, treating discovery as a mandatory prerequisite rather than an optional first step. Valenzuela and co-author Douglas McKee write that "agent tool access must be modeled as a distinct identity and policy enforcement problem, not as an extension of the user who deployed the agent," arguing that every agent needs its own identity with permissions tied to the active task.
The analysis warns that traditional audit cycles can't keep pace with agents that deploy and replicate in seconds, leaving organizations vulnerable to attackers who could instruct compromised agents to spawn short-lived clones that inherit access, complete malicious tasks, and terminate before any periodic review catches them. The report recommends correlating signals from network traffic, endpoint telemetry, browser logs, and identity systems to build a complete inventory, since no single vantage point captures agents running across networks, endpoints, browsers, and external SaaS platforms. Tools like LLM gateways can centralize visibility and governance, but only for agents already pointed at them, looping the problem back to the missing inventory they're meant to solve. The full checklist walks through three tiers—inventory and governance, architecture and enforcement, detection and response—in the sequence they're designed to happen, with Valenzuela teaching a deeper walkthrough in the SEC530 course at SANS Cyber Defense Initiative 2026 this December. Organizations that layer enforcement on top of unknown agent populations risk building policy frameworks with nothing real to enforce against, leaving legitimate use cases and shadow deployments equally invisible until an incident forces the issue into view.