What Real-World Data Tells Us About Agentic Endpoint Risk

What Real-World Data Tells Us About Agentic Endpoint Risk

Data and findings from Backslash enterprise users assessments

Since we started investing in agentic endpoint security, we've seen numerous enterprise environments and saw first hand what rattles security teams. AI agents are gaining access to local files, business systems, and command execution, while visibility into their use remains limited.

Many organizations govern adoption through lists of approved AI products and models. But the same approved agent can operate differently on each employee’s endpoint. Connected MCP servers, installed skills and plugins, instructions, memory, and personal accounts form an agentic fabric that shapes its behavior and access to data. Product approval alone does not establish its security posture.

Backslash’s enterprise assessments reveal the exposure this gap creates. Credential-related risks appeared in 60% of assessed environments, and a scan of just six endpoints surfaced 31 policy violations. Yet 79% of organizations described having little to no visibility into their agentic AI inventory, limiting their ability to identify and address these risks.

This report examines those findings to show how agentic AI operates inside enterprises, where existing security architectures fall short, and what these gaps mean for security and governance.

Key Findings

#1: Agent Density Exceeds One per Endpoint

Employees run ~1.4 AI agents or coding agents on their endpoints, on average (not including subagents that agents spawn as needed). They may be using different agents for different workflows and use cases, or for experimentation purposes. For example, a developer might use one agent for coding, another for research or documentation, and install others to test a new capability.

Each agent installation has a different security posture, even when using the same approved product. Locally installed skills, MCP server connections, automation rules, granted permissions, and sign-in accounts vary across agents on the same endpoint. These agentic fabric components can expand each agent’s available tools, introduce new instruction sources, or provide paths to local files and external services in different ways. Software procurement approval does not equal configuration hygiene.

#2: Most Organizations Lack Agentic AI Inventory Visibility

79% of organizations describe having little to no visibility into what AI agents, tools, or models were actually running across their environment. None of them expressed confidence in having a complete inventory. The gaps ranged from having no tracking at all, to relying on tools (EDR, firewall/DNS filtering) that weren't built to see this layer and reportedly missed it.

As agents gain access to sensitive data and take actions across business systems, this visibility gap impedes the organization’s ability to understand and govern agentic use. For example, in one case, a security team investigating a rogue AI agent that had deleted data could not determine which agent was responsible or locate the relevant logs.

#3: Shadow AI is Widespread

Shadow AI is when employees download unvetted extensions or CLI agents to accelerate workflows, bypassing procurement and central security review. Rogue agents are approved agents that have had their execution parameters modified via unauthorized community skills, insecure MCP server connections, or local override configs. This grants them system access and data-handling privileges that security teams never sanctioned.

In one enterprise assessment, 57 agents were classified as unapproved among roughly 700 detected, about 8%. In another, 210 of roughly 600 coding agents were flagged for policy violations, or about 35%. At a third, smaller customer, 7 of 22 agents detected were unapproved, about 32%.

#4: Personal AI Account Usage Appeared in Every Assessment

Backslash identified employees using personal accounts to access AI coding agents on their enterprise endpoints in every customer assessment where account usage was scanned and reported. The worst offenders were 46 users in a 234-endpoint enterprise scan (20%). Across assessments with a clearly established endpoint count, personal-account usage ranged between 5%-–20% of scanned endpoints.

When an approved agent is used through a personal account, that usage is outside the organization’s company-managed identity controls. This means that company data and agent activity may fall outside the organization’s ability to enforce access policies, retain audit records, leak enterprise data to other endpoints using the employee’s personal account, and revoke access when an employee leaves.

#5: Unapproved AI Models Were in Active Use in Two-Thirds of Assessed Environments

Backslash detected unapproved or policy-violating AI models in active use in approximately 67% of customer environments where model usage was directly scanned and reported. Many companies do not approve the use of DeepSeek, but findings included Google Gemini usage in environments that permitted only OpenAI and Anthropic models, as well as other models outside an organization’s OpenAI-and-Google-only policy.

These findings show a gap between defining an approved-model policy and enforcing it. Organizations need visibility into the models employees actually use to verify whether usage stays within those boundaries.

#6: Credential Exposure Risks Appear in 60% of Assessed Environments

In 60% of the customer environments assessed, we identified at least one exposed secret, hardcoded credential, or instruction directing an agent to harvest credentials. The findings took three distinct forms:

1. Credentials embedded in rules or skills, i.e, directly into the agent’s configuration files or custom workflows. Because configurations and prompts are shared or reused across teams, the secrets can spread widely and can easily leak.
2. Agents exfiltrating credentials from .env files, abusing local file-access permissions to steal and transmit confidential environment variables.
3. Prompt injection directing agents to collect secrets, overriding the agent's safe behavior, and turning it into a credential harvester.

#7: A Small Endpoint Footprint Can Contain Substantial AI Risk

Some AI risks extend across many users; others can accumulate within a small number of endpoints. In one customer assessment, Backslash scanned just six machines and identified 31 policy violations, each tied to a specific AI agent, rule, or setting that could be pinpointed and remediated.

This assessment shows that even a small AI footprint can contain multiple security issues. Counting users or agent installations alone does not reveal the extent of exposure: security teams also need to assess the configurations and capabilities present on each endpoint.

‍

#8: Organizations Average 126 MCP Servers, with Security Findings in 4.4% of Those Servers

Across assessed customer environments, Backslash identified an average of approximately 126 MCP servers per organization. An average of 5.6 servers per organization had at least one security finding. Overall, 4.4% of identified MCP servers were flagged.

These connections expand what agents can access and do. The same approved agent can connect to different MCP servers across employee endpoints, each with its own tools, permissions, and configuration. Approving the agent alone therefore does not establish the security posture of its connected servers.

#9: Assumed Coverage and Approval Friction are Top Barriers to Better Security

What’s blocking better agentic AI security across organizations? We asked enterprises what delays agentic AI security processes. As the chart below shows, reliance on existing security tools and process overhead were the most frequently cited blockers to stronger agentic AI security, with budget constraints close behind. Organizations had assumed their EDR, DLP, or other tools already provided sufficient coverage, or faced approval workflows involving multiple stakeholders and executive sign-off.

Less frequently cited barriers included a lack of dedicated AI security tooling, unclear ownership across security, IT, and engineering, adoption outpacing governance, and limited internal expertise or staffing. The pattern suggests that improving security requires both identifying gaps in existing coverage and creating a clear path to act on them.

What’s blocking better AI security?

#10: Lack of Visibility Leads Agentic AI Security Priorities

Visibility into active agents, MCP servers, connected workflows, and personal-account usage was the most frequently stated security priority among enterprises. Data and credential exfiltration followed, with concerns centered on sensitive business systems, excessive permissions, exposed credentials, and potential leakage.

These priorities reveal a practical challenge: security teams need to assess what agents can access and disclose, but often lack a reliable inventory of the agents and configurations operating in their environments.

Compliance and audit readiness were also recurring priorities. Organizations linked AI governance to audit evidence and requirements associated with ISO 27001, SOC 2, and NIST. Without visibility into agent activity and configuration, teams struggle to establish which usage is governed and demonstrate that relevant controls are applied.

What the Findings Mean for Enterprise Security

• Procurement approval misses endpoint-level Shadow AI: Evaluating software solely at the vendor level leaves critical blind spots. Shadow AI now takes two forms: employees adopting unsanctioned third-party vendors, and employees reconfiguring approved agents with unvetted community skills, local MCP servers, and custom rules that bypass central security review.
• Legacy security stacks miss the agentic layer: Existing EDR, CASB, and DNS tools are blind to agentic behaviors like semantic tool-calling and skill execution.
• Personal accounts shatter corporate identity perimeters: Operating agents under personal logins prevents centralized access revocation, bypasses compliance logging (SOC 2, ISO 27001), and risks enterprise IP leakage to unsanctioned model histories.
• Credential leakage becomes an active attack vector: With 60% of environments exposing secrets via hardcoded skills, exposed configuration files, or prompt injections, autonomous agents frequently operate as inadvertent credential harvesters.
• Security must shift from static approval to continuous runtime governance: Gaining true control requires real-time discovery of the entire agentic fabric: mapping active agents, inspecting connected tools, enforcing enterprise identities, and monitoring runtime execution.

‍

Enterprise governance needs to account for how agents are configured, which identities and tools they use, what resources they can access, and what actions they take. As agentic AI adoption expands, it is currently outpacing security teams' ability to understand and mitigate the risks it creates. Therefore, security teams need the visibility and controls to verify that policies are enforced in practice and address risks wherever agents operate.

‍

How Backslash Can Help

Backslash supports discovery, risk assessment, and runtime governance for agentic AI across employee endpoints:

• Agentic Fabric Discovery: Identify agents and associated skills, MCP servers, local models, connectors, and plugins, giving security teams an inventory to assess and govern.
• Continuous Risk Assessment: Inspect agent configurations and connected components for exposed credentials, insecure permissions, network exposure, and other security findings.
• Policy Enforcement: Apply organizational policies to detected agents and components, including restrictions on unapproved usage.
• Inline Runtime Protection: Monitor supported agent operations and block actions that violate configured security policies.
• Activity Tracing: Record agent prompts, processes, tool calls, and resulting actions to support investigations, incident response, and audit evidence.

‍