We Found Consumer Agents Sitting Inside Enterprise SaaS

Agent discovery

‍

In recent weeks, Reco’s Agent Discovery engine flagged an alarming pattern across enterprise production environments: consumer personal agents connected directly to core SaaS suites. Not isolated test environments or developer sandboxes, but corporate Google Workspace tenants, mission-critical business platforms, and central messaging workspaces.

‍

The users establishing these connections were not junior employees experimenting in silos. They were C-level executives. In the majority of instances, they granted these agents expansive OAuth privileges—full read and write delegation across corporate email, executive calendars, and cloud storage drives.

‍

These connections surged between late August and mid-September 2026, tracking almost 1:1 with mainstream media coverage and valuation spikes for consumer personal assistants. No security architecture board reviewed them. No procurement workflow evaluated them. An executive read about an autonomous assistant on their phone, clicked "Sign in with Google," consented to permissions, and granted an unvetted third-party agent continuous administrative reach into enterprise systems in under sixty seconds.

‍

Instinct was the initial signal, but it’s not the only one.

‍

Since early September, Reco telemetry has identified parallel connection patterns across a spectrum of consumer and personal agents—including Meta’s Muse, an application named Grok accessing Gmail, Calendar, Drive, and Slides, and Grok Bot, which programmatically generates custom Slack bot applications per user. None was provisioned through corporate IT. In every case, employee consent served as an immediate, unmonitored backdoor.

‍

What these agents are (and why they don't belong in the enterprise)

‍

Instinct, which launched its invite-only personal agent in August 2026 and saw its valuation leap from $2.5B to $10B within weeks, exemplifies this new class of personal autonomous agent. Designed to text, call, schedule travel, order groceries, and manage personal logistics, Instinct operates autonomously across phones and web sessions. Furthermore, its built-in "Trusted Person Network" allows one user’s assistant to coordinate directly with peer assistants to share files, reconcile calendars, and execute tasks across identity boundaries. That consumer convenience is precisely the enterprise threat.

‍

Instinct and its peers were architected for personal consumer utility, not enterprise workforce membership. They lack enterprise multi-tenancy, centralized administrative consoles, role-based access control (RBAC), formal Data Processing Agreements (DPAs), and enterprise audit logging. When a consumer agent’s network enables assistant-to-assistant file sharing, a confidential corporate board deck sitting in an executive’s Google Drive is literally one unverified autonomous hop away from an external third party's personal agent.

‍

Telemetry & field data: an unmanaged risk, not a productivity perk

‍

When an executive connects a consumer agent to corporate accounts, the enterprise inherits an autonomous non-human identity (NHI) endowed with executive-level authorization—but devoid of enterprise security controls, policy boundaries, or human discretion.

‍

Reco’s threat research and SaaS audit telemetry across customer tenants reveal the tangible blast radius of this phenomenon:

1. Active Execution and Data Manipulation
   Consumer agents do not merely ingest context—they take actions. Across environments where Reco maintains deep SaaS audit logging, Instinct actively edited and created files—including documents explicitly classified as Confidential—and registered as an active bot user inside Slack. Similarly, the Grok application generated approximately 1,700 distinct Google Drive actions over a six-week observation window. While reads formed the baseline, the agent actively modified existing documents, uploaded files, generated new assets, renamed existing structures, and sent two corporate files to the trash bin.
   ‍
2. The Cross-Tenant Exposure Blindspot
   Perhaps the most critical vulnerability uncovered is cross-tenant file leakage. Reco observed approximately 200 unauthorized Drive read operations executed by an app named Grok, connected by individuals outside the file-owning enterprise. These external users held access to files shared externally or set to "anyone with the link."
   
   Several victim organizations had already instituted internal security blocks prohibiting their own employees from connecting Grok. The internal block functioned as designed, yet did nothing to prevent an external contractor, partner, or counterparty’s agent from reading sensitive corporate files. Traditional app controls stop at your tenant boundary; agentic data consumption traverses it seamlessly.
   ‍
3. Silent Persistence and "Dormant Agent Debt"
   An agent does not need to be actively executing to represent critical risk. Approximately 40 employees across twelve distinct customer organizations connected Meta’s Muse, starting the day following its public announcement. Most granted broad Calendar access, many authorized Gmail scopes, and a subset granted full Drive access. While our Drive telemetry showed zero post-connection file operations from Muse during the window, the broad delegated OAuth grants remain fully active. These dormant grants represent persistent, unmonitored attack paths waiting to be leveraged or compromised.
   ‍
4. Cascading Identity Creation
   Grok Bot introduced a distinct identity sprawl challenge: it bypassed centralized application inventories by leveraging an existing, approved Slack integration to programmatically spawn individual, user-specific Slack apps named by each employee. Where automated Slack app approvals were active, these bespoke bots were approved with a single click. Reco detected at least one sensitive file exfiltrated via this mechanism before remediation.
   ‍
5. Disproportionate Executive Blast Radius
   Because early adoption of high-profile personal agents is concentrated among leadership and executives, the accounts compromised by broad OAuth delegation hold the organization’s most confidential assets: quarterly financials, unannounced M&A documentation, executive compensation, and strategic board presentations.

‍

Why legacy security architectures are completely blind

‍

This vector evades the standard enterprise defense stack by design. Every stage of the connection bypasses conventional security instrumentation:

• No Endpoint Visibility (EDR / MDM): Executives initiate connections from personal smartphones or unmanaged browsers during off-hours. No corporate MDM or EDR agent ever inspects the device.
• No Network Visibility (CASB / SWG / Firewalls): These agents operate entirely within the vendor’s cloud infrastructure. Communication occurs via direct cloud-to-cloud API connections between the vendor and the SaaS provider (e.g., Meta or Instinct cloud to Google Workspace). Zero network packets touch the corporate firewall, VPN, or Secure Web Gateway.
• Bypassed Conditional Access Policies: When Google and Microsoft authenticate these grants, the OAuth consent request frequently originates directly from the vendor's cloud server IP, rather than the employee's workstation. Device health, compliant network, and location checks configured in Identity Providers (IdPs) evaluate the vendor's server and pass without alerting.
• The "Overcounting vs. Undercounting" Inventory Dilemma:
  Standard application inventories built on static vendor names fail completely:
  
  • Undercounting (Muse): Meta’s Muse requests separate granular OAuth consents per Google service (Gmail, Calendar, Drive, Contacts, Tasks) originating from Meta’s network. An employee may connect Calendar without connecting Drive. A static security scan looking for a single unified "Muse" app severely undercounts real footprint and exposure.
  • Overcounting (Grok): In our telemetry, approximately 500 employees across 40 organizations utilized Grok strictly for basic SSO ("Sign in with Google," which exposes only name and email). Concurrently, ~50 employees granted full data-access scopes to email and files. A naive scan based on application name treats all 550 events as identical risk, burying the critical 50 data-compromise events in noise.
  • Polymorphic App Naming (Grok Bot): Because Grok Bot creates dynamically named Slack apps per user, signature-based app cataloging fails to detect the underlying pattern.

If your discovery mechanism relies on endpoint agents, network proxies, or static OAuth app-name lists, you are systematically blind to cloud-to-cloud agent adoption.

‍

Securing the SaaS fabric against shadow agents

Addressing this threat requires transitioning from reactive endpoint blocking to active, context-aware SaaS and non-human identity governance.

1. Restrict Self-Service OAuth Consent and Sub-App Spawning Immediately

• Google Workspace: Enforce strict API access controls. Configure Google Workspace to restrict Gmail and Drive scopes strictly to explicitly allowlisted, vetted third-party applications. Ensure unvetted applications are restricted to basic authentication (OpenID/profile) only.
• Microsoft Entra ID: Disable end-user consent for third-party multi-tenant applications. Require administrative review for any application requesting permissions beyond basic low-risk sign-in scopes.
• Slack: Mandate admin approval for all workspace application installations. Crucially, enforce policies that prohibit installed integrations from programmatically registering secondary bots or child applications without dedicated security review.

2. Neutralize the External Sharing Surface

Blocking an agent internally does not protect corporate data shared externally.

• Audit and remediate all corporate Drive and SharePoint files configured with public links ("Anyone with the link can view/edit").
• Enforce expiration dates on external file shares and conduct automated reviews of sensitive collateral accessible by external contractors and partners whose unmanaged personal agents may ingest your data.

3. Separate Identity Authentication from Data Authorization

Differentiate basic SSO sign-in from persistent data delegation. A user signing into an external service using their corporate email identity does not equate to granting that service read/write privileges over their inbox and cloud storage. Security teams must monitor and alert on data-scope escalation rather than treating all OAuth interactions as uniform risk.

 4. Audit Active Behavior and Revoke Dormant Access

• Maintain continuous behavioral auditing across your SaaS fabric. Flag anomalous operations such as bulk file modifications, unexpected deletions, programmatic file renames, and unauthorized bot registrations.
• Recognize that revocation does not equal deletion: Simply revoking an OAuth token prevents future API calls, but does not wipe data already ingested, cached, or embedded in a vendor’s training or retrieval architecture. Third-party vendor terms frequently state that indexed customer context is retained post-disconnect. Establish clear vendor risk protocols for offboarding unauthorized AI tools.

Agent governance demands an interconnected context graph

The rapid proliferation of consumer agents into enterprise systems proves that AI adoption will not wait for formal procurement cycles. Employees and executives will bring the tools that maximize their personal efficiency directly to where their work lives—inside enterprise apps.

Securing this ecosystem cannot be accomplished with isolated point tools. Protecting against shadow agents requires a multi-sensor context graph that continuously correlates identity, OAuth permission scopes, real-time behavioral audit trails, and cross-organization data sharing relationships across the entire SaaS ecosystem.