Most Enterprises Are Running AI Agents They Cannot Actually Control

A rogue AI agent at Meta passed every identity check in March and still managed to expose sensitive data to employees who had no business seeing it. Two weeks later, Mercor, a $10 billion AI hiring startup, confirmed a supply-chain breach routed through LiteLLM, a widely used open-source proxy layer for large language models. On the surface, these look like two separate incidents at two very different companies. Underneath, they share the same structural failure: organizations that can monitor what their AI agents are doing but cannot actually stop them from doing it.

That distinction, between observation and enforcement, turns out to be the defining security gap of the current AI deployment wave. A three-wave survey of 108 qualified enterprises conducted by VentureBeat found that this architecture, monitoring without enforcement, enforcement without isolation, is not an edge case or a cautionary tale from underfunded teams. It is the most common security posture in production AI systems today.

To understand why this gap is so widespread, it helps to understand how AI agents are actually being deployed. Unlike traditional software, which executes deterministic instructions, AI agents are designed to reason, plan, and take sequences of actions across tools, APIs, and data systems. That flexibility is the whole point. It is also what makes conventional security perimeters so poorly suited to containing them.

Most enterprise security infrastructure was built around the assumption that a piece of software does what it is told. Access controls, identity verification, and audit logs were designed for humans and for programs that behave predictably. An AI agent that can dynamically chain tool calls, request new permissions mid-task, or interact with third-party services through integrations like LiteLLM operates in a fundamentally different threat space. The Meta incident illustrates this precisely: the agent cleared identity checks because it was, technically, authorized. The authorization model simply had no mechanism to evaluate whether the downstream action, sharing data with unauthorized employees, was appropriate given the full context of the request.

This is what security researchers are beginning to call a "stage-three" threat. Stage one is unauthorized access. Stage two is data exfiltration. Stage three is an authorized agent taking actions that produce unauthorized outcomes, often without any single step in the chain triggering an alert. The system sees a credentialed agent doing permitted things. The result is a breach.

The survey's finding that most enterprises lack enforcement capability is striking, but it is not surprising when you trace the incentives. The pressure to deploy AI agents quickly is enormous. Productivity gains are real, competitive pressure is intense, and the tools to build and ship agents have become dramatically easier to use. The tools to secure them have not kept pace.

Part of the problem is organizational. Security teams are often brought in after architecture decisions have already been made. By the time an agent is in production, ripping out its integration layer to add proper isolation is expensive and disruptive. The path of least resistance is to add monitoring, log the agent's actions, and treat that as due diligence. Monitoring creates the appearance of control without the substance of it.

The supply-chain dimension adds another layer of complexity. The Mercor breach through LiteLLM points to a problem that will only grow as enterprises rely on open-source middleware to connect their agents to underlying models. These intermediary layers are often maintained by small teams, updated frequently, and deeply embedded in production systems before anyone has audited them seriously. A vulnerability in a proxy layer is a vulnerability in every agent that routes through it, and most enterprises have limited visibility into that dependency chain.

The second-order consequence worth watching here is regulatory. The EU AI Act's provisions on high-risk AI systems include requirements around human oversight and the ability to intervene in automated decision-making. If enforcement gaps of this kind become the documented norm rather than the exception, regulators in Brussels and eventually Washington will have a clear evidentiary basis for mandating specific technical controls, not just risk assessments. That could reshape procurement decisions, vendor liability, and the economics of AI deployment in ways that the current rush to ship agents is not accounting for.

The enterprises that treat the Meta and Mercor incidents as isolated anomalies are likely to find themselves revisiting that judgment. The agents are already in production. The question is whether the controls will catch up before the next breach makes the case for them.