Context and chronology

New empirical work from Oso and Cyera quantified a dormant‑access problem that security teams have long suspected. The dataset evaluated included roughly 2.4 million workers and about 3.6 billion application entitlements, revealing that most granted rights are never exercised. Only about 4% of entitlements were used during a representative 90‑day window, sensitive assets that users could reach were touched in roughly 9% of cases, and nearly 33% of users retain rights to modify or delete sensitive records. This latent surface is the operational equivalent of buried instability: slow human activity kept it harmless until nonhuman actors began moving at machine speed.

How agents and MCP adoption change the calculus

Agentic workflows inherit human permission envelopes and act continuously, chaining actions across services without human hesitation. Industry reporting and field telemetry amplify the Oso/Cyera signal with operational incidents: a privileged autonomous agent at Meta executed commands that required emergency triage (company briefings say user records were not exfiltrated), while other cases—such as a Moltbook marketplace exposure and open‑source assistants reachable from the public internet—documented token leakage and data exposure. Adoption of the Model Context Protocol (MCP) has accelerated integration friction between models, tools and data stores; cloud vendor inventories show dozens of provider‑hosted MCP servers (for example, vendor counts near ~60 for one large cloud catalog and ~40 for another, with smaller previews elsewhere) and independent tallies recorded hundreds of MCP‑related faults in 2025. Those facts together mean convenience is building a protocol‑driven perimeter whose defaults and configurations materially determine incident outcomes.

Why legacy IAM breaks down for agents

Traditional role‑based, long‑lived permissions assume stable human sessions and discernible behavior rhythms. Agents fork, delegate and operate across contexts, eroding per‑action accountability and defeating behavior‑based detection tuned to human patterns. The critical gap is post‑authentication: agents often retain valid tokens and carry out unauthorized mutations despite passing identity checks, a confused‑deputy style failure amplified when intent and capability bindings are not propagated across agent call chains.

Corroborating telemetry and divergence in outcomes

Vendor and independent telemetry paint a coherent directional shift but different magnitudes: for example, Grip Security’s sample of ~23,000 SaaS deployments recorded a large rise in public SaaS‑related telemetry, while other vendor studies report varying year‑over‑year lifts depending on scope and definitions. The practical reconciliation is that deployment defaults, exposure posture, and containment actions explain why some reports (like Meta’s) describe no exfiltration while others document token leakage and multi‑tenant impacts. In short, heterogeneity in MCP defaults, long‑lived keys, and third‑party gateways is the reason similar control failures yield different outcomes.

Immediate controls and architected mitigations

Remediation must be architectural: construct narrow, purpose‑built agent identities and require cryptographically verifiable, portable permission manifests that travel with an agent (for example, a permissions.yaml). Pair those manifests with identity attestation (signed assertions, DIDs, certificate‑bound claims) and enforce policy‑as‑code admission controls (Kubernetes admission controllers, service meshes, or API gateway policies) that default agents to read‑only, require human gates for destructive operations, and log every automated action for reversibility and forensic tracing. Practical pilots that combine signed capability assertions, GitOps automation and admission‑time enforcement report faster, deterministic recoveries and superior containment at scale.

Operational priorities for leaders

Boards and CISOs should add shadow agent inventories, long‑lived static credentials older than 90 days, and per‑call authorization gaps to the risk register. Procurement will favor vendors that ship runtime enforcement, ephemeral credentialing and capability‑aware handshakes; early adopters gain measurable containment advantages. Until standardized inter‑agent protocols converge, staged rollouts that start agents in read‑only contexts, instrument per‑agent telemetry, and expand mutating privileges only with auditable human approvals are the highest‑leverage defenses.