Gartner forecasts that task-specific AI agents will be integrated into 40% of enterprise applications by the end of the year. That’s up from less than 5%.

The systems meant to catalog what runs on a managed device haven’t kept pace. 46% of organizations automate endpoint inventorying and monitoring today, per Automox’s survey of IT professionals. That goes beyond a software inventory problem in the traditional sense. It’s the point at which software stopped waiting to be told what to do.

The Inventory Question Just Changed Shape Software inventory answers a static question. For most of the discipline’s history that was enough. Software on an endpoint did nothing until a person or a scheduler told it to. Resident agents break that premise. They read local files, call tools, invoke APIs, and take multi-step action in the gaps between the moments anyone’s looking.

The Inventory Question Just Changed Shape Software inventory answers a static question. For most of the discipline’s history that was enough. Software on an endpoint did nothing until a person or a scheduler told it to. Resident agents break that premise. They read local files, call tools, invoke APIs, and take multi-step action in the gaps between the moments anyone’s looking. So the useful question shifts to not what’s installed, but what it’s allowed to do and what it did. Cyberhaven Labs found enterprise adoption of endpoint-based AI-native apps grew 509% over the past year. BeyondTrust’s Phantom Labs put the rise in AI agents inside enterprise environments at 466.7% YoY. Both figures are vendor telemetry rather than industry-wide measurement, but they point the same way.

“Nobody gets everything right. But there’s a difference between being wrong and being wrong everywhere at once,” says Automox CEO Justin Talerico. “One bad call on one machine, you fix it and move on. That same call pushed across the fleet, suddenly you’re not fixing a mistake, you’re managing a crisis. Speed without scale is a learning curve. Speed at scale is a bet on your own judgment, every time. That’s the part people don’t consider until it’s too late.” The property that makes an agent useful, acting without waiting, is what turns an ungoverned one into a fleet-wide event.

“Nobody gets everything right. But there’s a difference between being wrong and being wrong everywhere at once,” says Automox CEO Justin Talerico. “One bad call on one machine, you fix it and move on. That same call pushed across the fleet, suddenly you’re not fixing a mistake, you’re managing a crisis. Speed without scale is a learning curve. Speed at scale is a bet on your own judgment, every time. That’s the part people don’t consider until it’s too late.” The property that makes an agent useful, acting without waiting, is what turns an ungoverned one into a fleet-wide event.

“Nobody gets everything right. But there’s a difference between being wrong and being wrong everywhere at once,” says Automox CEO Justin Talerico. “One bad call on one machine, you fix it and move on. That same call pushed across the fleet, suddenly you’re not fixing a mistake, you’re managing a crisis. Speed without scale is a learning curve. Speed at scale is a bet on your own judgment, every time. That’s the part people don’t consider until it’s too late.” The property that makes an agent useful, acting without waiting, is what turns an ungoverned one into a fleet-wide event.

Those events land on the endpoint team by definition. Most of those teams lack a clear view of their own estate. Only 36% told Automox they were very or extremely confident in their endpoint compliance visibility. Agents Inherit Privilege, They Do Not Request It An AI agent has no privileges of its own. It runs with the identity and permission scope of whatever launched it. That is BeyondTrust’s point on agent identity governance. The operating system can’t tell a command a person typed from one a model generated. None of that requires an exploit; it’s the design working as intended.

Revocation is the verb missing from most agent conversations. Inventory confirms an agent exists and scoping decides what it may do. What a fleet tool is uniquely placed to answer is what happens in the ninety seconds after someone decides it should stop.

The OWASP Top 10 for LLM Applications files this failure mode under Excessive Agency. It traces it to excessive functionality, excessive permissions, and excessive autonomy. Two of those three are permission problems. Its mitigations read like endpoint policy. Minimize what an agent can reach, execute in the user’s context, require approval for high-impact actions.

Most organizations aren’t doing it. IBM’s Cost of a Data Breach Report 2026 found that 92% of organizations reporting an AI-related breach lacked proper AI access controls. Only 40% apply access controls to AI models and data at all. Teleport’s 2026 Infrastructure Identity Survey measured the cost at a 17% incident rate for least-privileged AI access against 76% for over-privileged systems.

The controls that make an agent safe to run already make any automated change safe. Automox’s agent-facing Model Context Protocol integration ships with a read-only mode that disables every write operation through a single setting, tool access scoped by role, and correlation IDs written to an audit log on every invocation. That isn’t a new category of control, it’s endpoint governance applied to a caller that reasons.

The controls that make an agent safe to run already make any automated change safe. Automox’s agent-facing Model Context Protocol integration ships with a read-only mode that disables every write operation through a single setting, tool access scoped by role, and correlation IDs written to an audit log on every invocation. That isn’t a new category of control, it’s endpoint governance applied to a caller that reasons.

Ungoverned by Default Every governance framework here assumes a known population of agents. The population isn’t known. Verizon’s 2026 Data Breach Investigations Report found 67% of users reaching AI services from non-corporate accounts on corporate devices. 45% of employees now qualify as regular AI users on those devices, up from 15% a year earlier.

Shadow AI is now the third most common non-malicious insider action in Verizon’s data loss prevention dataset, a fourfold increase in percentage terms. The data type most often handed to unauthorized models is source code. IBM’s numbers run parallel: shadow AI incidents more than doubled to 43% from 20%, and 68% of breached organizations had no policy for managing or detecting it.

Blocking named tools doesn’t work when the category grows faster than the blocklist. Endpoint teams reached that conclusion about unsanctioned software a decade ago, and the answer was inventory, policy, and the ability to remove.

The resistance isn’t about value. Asked what holds them back from autonomous endpoint management, 46% of the IT professionals in Automox’s survey named data privacy and security implications, 44% the risk of incorrect or unauthorized changes, and 36% limited trust in AI-driven recommendations. What they want first is brakes: automatic rollback, named by 43%, and the ability to pause or override, named by 42%.

Scope, Then Trust The argument over whether AI agents belong under endpoint management has been settled by where they run. What’s left is an ownership question before it’s a technical one: which team holds agent inventory, who sets the permission scope, and how fast access can be withdrawn when that scope turns out to be wrong.

Contributed article. Not produced by the TNW newsroom and does not reflect the editorial stance of TNW.