2026-07-13 · Article

Agent Zero Trust and the 1,600-Agent Problem

A mid-2026 attack wave proved the sandbox is not the control you think it is. Meanwhile most organisations cannot answer the first question any auditor will ask: how many agents are you running?

By Frans Vermaak

For the Record: AI Governance Tools for SA Boards, Article 3 of 4

A sandboxed AI agent is not a governed one. It still treats everything it reads as an instruction, and the weeks since have supplied more confirmation of that than we wanted. Our previous series made the argument, with the Blast Radius Ladder, when it still sounded conservative: sandboxing an agent (Rung 2) is not governance.

The sandbox held. The agent still got owned.

Consider three pieces of security research published in the last few weeks, each post-dating everything in our earlier series.

Researchers demonstrated a clean-looking public code repository that hijacked an AI coding agent without containing any visible malicious code: a fake setup error led the agent to run an initialisation script that pulled its real payload from DNS records, a channel invisible to conventional scanners. Separately, a proof-of-concept showed that instructions planted inside error-tracking events, using nothing more exotic than a project's public error-reporting key, reached the AI agents connected to those error dashboards and achieved an 85 percent success rate across widely used coding agents. And a design flaw dubbed GuardFall showed shell-command safety checks being bypassed across open-source agents with roughly half a million combined GitHub stars, with researchers defeating multiple commercial skill scanners using tricks as blunt as shell substitution and base64 encoding to slip a payload past the check.

Note what is common across all three. No credential was stolen. No sandbox was escaped. In each case the agent did exactly what its permissions allowed, because the attack arrived as content the agent trusted: a repository README, an error event, a skill file. The perimeter held; the words got in. That is a content-trust failure, and it is precisely the gap between Rung 2 and Rung 3 of the ladder. Multi-agent systems widen it further: a recent jailbreak study of collaborating agent frameworks reached an 89 percent success rate, with agents amplifying rather than checking one another's compromised instructions.

The security industry's response has a name now, borrowed deliberately from network security: Agent Zero Trust. Treat every agent as a potential insider threat. Give it a verifiable identity, the narrowest tool access it needs, and an audit trail of its actions, and assume the content it reads is hostile until proven otherwise.

The part nobody budgeted for: sprawl

Zero trust presumes you know who the actors are. Here the numbers turn uncomfortable.

Industry research this year puts large enterprises on track to run more than 1,600 AI agents each by the end of 2026. Against that: 18 percent of organisations maintain a current inventory of their agents, 12 percent have any centralised way of managing agent sprawl, and 21.9 percent treat agents as independent, identity-bearing entities in their access systems, the same stubborn one-in-five figure we cited in the last series, unmoved while deployment has accelerated. Eighty-eight percent of organisations reported a confirmed or suspected AI-agent security incident in the past year. And the delivery side is no prettier: analyst forecasts now expect over 40 percent of agentic AI projects to be cancelled by the end of 2027, with the overwhelming majority of pilots never reaching production at all.

Put those together and the strategic picture is stark. Organisations are deploying agents faster than they can count them, cannot attribute agent actions to distinct identities, and are already experiencing incidents, while the attack techniques above specifically exploit the trusted-content channel that sandboxing does not close.

Every audit discipline in history starts the same way, and so does this one: with an inventory. You cannot revoke an identity you never issued, kill a process you cannot name, or investigate an action log that attributes everything to one shared service account. When we assess an organisation, the agent register is the first evidence we request, and the most common answer is the reason this article exists: "we would have to check."

The artefact: the AI Agent Inventory

File this. One row per agent or autonomous AI process, including the ones inside vendor products and the ones a developer set up "temporarily". If completing it takes more than a day of asking around, that fact belongs in your next risk committee pack.

Two uses for the completed register. Internally, the rung column is your prioritised remediation list: anything at Rung 1 touching production or personal data is this quarter's problem, not this year's. Externally, this is the first page of evidence for the auditor, the underwriter (see Article 2 in this series) and, under King V's technology-governance principle, the board pack.

For the record

The research did not reveal new agent capabilities. It revealed that the words an agent reads are an attack surface, that the industry's scanners can be beaten with a few blunt tricks, and that most organisations could not name the agents involved if it happened to them. Zero trust for agents starts embarrassingly small: a register, an owner per row, an honest rung. Fill it in before the incident does it for you.

Sources: 0DIN (Mozilla) research on repository-based agent hijacking via DNS TXT payloads ("Clone This Repo and I Own Your Machine"), 29 June 2026; Tenet Security "Agentjacking" research on prompt injection via public error-tracking DSNs against MCP-connected coding agents (85 percent success across Claude Code, Cursor and Codex), June 2026; GuardFall shell-injection design flaw and skill-scanner bypass research, June 2026; IMA multi-agent jailbreak study (89 percent average success across MetaGPT, CrewAI, AutoGen and ChatDev); Gravitee, State of AI Agent Security 2026 (88 percent incident rate; 21.9 percent identity-bearing agents); IBM enterprise agent projections (1,600+ agents; 18 percent inventory; 12 percent sprawl management), via Beam.ai analysis; Gartner forecast that over 40 percent of agentic-AI projects will be cancelled by end of 2027; Tech Sight, Agentic Coding & Governance series and the Blast Radius Ladder, techsight.co.za.