Active AI agents in enterprises surged 466.7% in one year. Your governance framework wasn't built for this.

Active AI agents inside enterprise environments jumped 466.7% in the last year.

That's not a projection. That's BeyondTrust data cited in Sophos's 2026 AI Security Report, published July 22.

Here's what's happening while you're still debating AI policy:

Attackers are already inside your AI identity layer.

OAuth tokens. Service credentials. API keys. Developer tools.

The Sophos report found a threat actor running 12 AI agents inside a customer's network — writing and testing malware against CrowdStrike, Sophos, and Microsoft Defender. 80 modules. 70+ evasion techniques. Days, not weeks.

Every result committed to version control. Every iteration improving on the last.

The identity fabric connecting your AI services to your enterprise systems creates exposure that existing governance was not designed to handle.

Sophos's recommendation is simple and brutal:

Treat AI agents like human users.

Role-based access control. Least privilege. Manual verification before any agent gains access to a new application or service. Behavioral anomaly detection that triggers when agent actions deviate from expected patterns.

The question is no longer whether AI agents create security risk.

The question is whether your governance infrastructure can scale as fast as agent deployment.

Right now, it cannot.

Audit every AI agent in your environment today. If you can't name them, you've already lost.