On October 15, India’s national CERT, CERT-In, issued a critical advisory. AI agents that AI model providers were running during research and evaluation had reached the live systems of Indian organizations and read business records, including personal data and confidential material. None of the affected organizations detected it. Every case came to light because the providers disclosed it after their own review.
Source: CERT-In, advisory CIAD-2026-0049, Oct. 2026.
Two weeks later, on October 30, Chainalysis disclosed that it had detected an external actor using “offensive agentic techniques” to gain unauthorized access to its systems and internal tools. It found no indication that investigation content, clear-text passwords, MFA secrets, or session tokens were accessed. Some customer account details, such as user IDs, names, and email addresses, were accessed.
Source: Chainalysis, Security Incident Information, Oct. 2026.
Neither case involved an agent the victim deployed. Controls built around your own agents don’t reach agents someone else is running.
Part 1: Finding it a day later isn’t protecting it
Part 2: Most agents reach sensitive data with no verified DLP
What the vendors say
PKWARE’s earlier series, “The Data, Not the Agent,” covered BigID and Varonis. Here is what five more vendors say in their own published material, paraphrased and dated.
| Vendor and month | What it says it does for AI agents |
|---|---|
| Cyera, Aug. 2026 | Agent Guardian inventories agents across endpoints, SaaS, and cloud, including shadow agents and MCP servers, and maps the data each can reach. Cyera Endpoint extends the controls to devices. |
| Securiti, Feb. 2026 | Agent Commander, introduced with Veeam, detects AI risk, applies runtime guardrails, and can roll back what an agent did. |
| Immuta, Mar. 2026 | Agentic Data Access gives agents their own identity, attributes, intent, and audit trail, and grants access when it is needed instead of as standing privilege. |
| OneTrust, Sept. 2026 | CORIE enforces enterprise policy at runtime while agents work, and records their decisions. |
| Informatica, May 2026 | Agent Fabric Context Catalog: one place to discover, govern, and operate data assets and AI agents together. |
Read the verbs
Inventory. Detect. Monitor. Govern. Enforce. Roll back. Every claim in the table is about the agent, the identity behind it, or the session it runs in. That is real work, and these are serious platforms. But Cyera’s own release describes shadow agents and MCP servers that security teams did not know existed, and CERT-In’s advisory describes agents run by someone else, which none of the affected organizations detected.
The other side of the argument
Most of the field is fencing the agent. We fence the data.
CERT-In says these agents got in using credentials left in application configuration and public code repositories, and cloud roles with too much access. A credential like that opens what that identity can open. It doesn’t come with a key unless that identity was given one. Protection on the data changes what they find. When PK Protect encrypts a supported file, the protection stays on the file after it moves. PK Protect’s key management issues the keys, and your directory groups decide who can use them. An agent that hasn’t been given a key can reach the file and still can’t read it. On supported databases, warehouses, and cloud storage, sensitive values are masked, so there is nothing to unlock. Adding more agents doesn’t change the protection on the data.
PK Protect doesn’t inventory agents or monitor their intent. The vendors above do. How that fits with protection on the data, for agents with their own identity and for assistants working on a person’s behalf, is in Part 2 of “The Data, Not the Agent.” You can’t govern every agent. You can decide what they find.
Four questions for any AI security pitch
| The pitch (paraphrased) | Ask this |
|---|---|
| We inventory every agent. | What protects the data that an agent we missed can reach? |
| We enforce policy at runtime. | What happens to the file when the policy is not in the path, or fails? |
| Agents get least-privilege access. | Is the file still protected after an authorized agent copies it somewhere? |
| One control plane for people, machines, and agents. | Can the same platform encrypt, mask, or redact the data, or does it report on it? |