The discourse surrounding AI agents is shifting from rapid deployment to urgent security considerations. Incidents like the intrusion at **Hugging Face** during an evaluation of **OpenAI** agents underscore the critical need for organizations to prioritize security over speed. Security teams are increasingly questioning the reach of AI agents and the potential for undetected malicious activity. While the temptation is to jump directly to enforcement, a foundational step — visibility — is often overlooked. Research from **Veeam** reveals a concerning trend: 70% of organizations admit that AI workflows are interacting with sensitive corporate data without adequate oversight. Furthermore, 67% report that IT cannot fully track the autonomous workflows employees are building. This 'Shadow AI' exemplifies the pervasive challenge of maintaining visibility over AI agents. **Zero Trust** principles offer a robust framework for AI governance, but the order of implementation is crucial. The **SANS** cheat sheet, "**Zero Trust for AI Agents: The Security Checklist**," emphasizes inventory as a foundational prerequisite. Attempting to enforce policies or authorization schemes on unknown agents with undefined scopes and no named owners is a recipe for failure. Below, we explore three key visibility challenges, offering insights into attacker methodologies ("Think Red") and actionable defense strategies ("Act Blue"). ## Challenge One: Agent Use Is a New Form of Shadow IT New technologies often see rapid adoption before governance catches up. When security teams identify this gap, the initial response is often prevention – blocking unapproved tools or cutting off access. However, this approach risks stifling legitimate innovation alongside rogue deployments. While **Shadow IT** is a well-understood problem in other domains, its manifestation with AI is still in its nascent stages. **Think Red:** An invisible agent provides an easy foothold for attackers. A recent incident at **METR**, a non-profit known for evaluating the **Hugging Face** incident, serves as a stark example. An attacker discovered an employee’s personal **EC2** instance running an agentic application, bypassed authentication, and prompted the agent to reveal its model provider API key. Over three weeks, the intruder racked up an equivalent of $600,000 in tokens due to the absence of spending limits. **METR's** internal dashboard failed to flag the activity, as it didn't display rate-limited requests, and token volume alone wasn't enough to trigger alerts. **Act Blue:** Lessons from cloud security can guide our approach to AI agent visibility. Just as organizations now meticulously monitor **AWS/Azure** usage and spending, similar controls must be applied to AI. Treat AI and agent spend, along with API key issuance, as crucial discovery signals. Leverage finance and procurement data as additional vantage points. Establish an approved-provider path before implementing blanket blocking measures, ensuring legitimate use cases are accommodated. The guiding principle should be: "know first, then restrict." ## Challenge Two: No Single Camera Can Take the Full Picture Achieving comprehensive visibility of AI agents is complex, as they reside across various environments: networks, endpoints, browsers, and SaaS platforms. Relying on a single monitoring lens inevitably leaves significant blind spots. Traffic to AI providers is often **TLS**-encrypted, meaning inline sensors only see destinations and byte counts, not prompts, tool calls, or data exfiltration. This traffic often blends with legitimate applications, making network analysis alone insufficient. Endpoint tools miss browser-embedded AI, and **SaaS**-embedded AI remains invisible to both. **Think Red:** Consider a marketing analyst installing a browser extension that summarizes customer records and drafts emails. Endpoint tools won't detect it, as it operates within the browser. Network monitoring will only observe encrypted traffic to a domain hosting numerous sanctioned **SaaS** products. This tool, and any attacker who compromises it, could gain access to sensitive **CRM** data without anyone realizing its existence. **Act Blue:** Comprehensive visibility requires correlating data from multiple sources. While traffic can be easily camouflaged, metadata can reveal interactions with model providers through **DNS/SNI**, **JA4** fingerprints, and egress-proxy logs. Augment network visibility with endpoint telemetry on processes, API keys in environment variables, or local agent runtimes. Furthermore, monitor browser-level telemetry for extensions, in-page copilots, and enterprise-browser logs. Integrate identity and **SaaS** logs, including **OAuth** grants, API key issuance, and provider admin consoles. Correlating these diverse signals can provide a robust inventory. While an **LLM** gateway like **LiteLLM** can centralize visibility and act as a policy enforcement point, it only governs agents already configured to use it. This loops back to the fundamental challenge of discovering unknown agents. ## Challenge Three: Audits Need to Keep Pace With What You’re Auditing Traditional auditing and monitoring practices are often inadequate for the dynamic nature of AI agent deployments. An annual review provides a snapshot of assets from a year ago, rendering it largely irrelevant in an environment where agents can be deployed and cloned in seconds. By the time a review cycle concludes, the inventory it produced is already outdated. Continuous monitoring is the obvious solution, but removing human oversight introduces its own set of risks. **Think Red:** In organizations with periodic audits, an attacker could exploit this by instructing a compromised agent to spawn short-lived clones to perform malicious tasks. These clones inherit the parent's access, exfiltrate data, or execute other illicit activities, then disappear before the next scheduled review, leaving no trace. **Act Blue:** A multi-faceted approach is necessary. Implement a system where both humans and other agents observe agent activity, preventing a single point of failure. However, it's crucial to maintain human accountability; even with automated monitoring, a named individual must be responsible for the outcomes reported by automation. Proactive risk mitigation can be achieved through quality gates. Recent legislative discussions in the **US**, including calls for an "emergency shutoff" (or "kill switch") for autonomous AI, highlight the growing concern around controlling these systems. However, as with all security controls, a kill switch is only effective if you know what to switch off, reiterating the primacy of visibility.