Your clients are hiring a shadow workforce — Copilot Studio flows, Salesforce Einstein actions, n8n automations, coding assistants with tokens into production repos, MCP servers wired into internal data. They’re not paying it, not onboarding it, and mostly not telling you about it.
BeyondTrust’s Phantom Labs clocked a 466.7% year-over-year jump in enterprise AI agents. Sophos’s AI Security 2026 Report calls this “the fastest-growing source of new exposure” businesses face right now. Attackers noticed first — and if you’re an MSP, this is squarely in your lane.
The reframe: AI risk is identity risk
“AI security” sounds like a model problem — jailbreaks, hallucinations. What’s actually breaching organizations this quarter is boring: stolen tokens, over-privileged service accounts, unaudited machine identities. Sophos’s Active Adversary Report 2026 found 67% of incidents its IR teams investigated last year were rooted in identity compromise. The same 67% shows up in the State of Identity Security 2026 as the share of ransomware cases that started with a compromised identity.
Now layer on the AI agent boom. Non-human identities already outnumber humans 45-to-1 or higher — 100-to-1 in some environments — yet only 34% of organizations regularly audit or rotate them. Just 11% do it continuously. Attackers don’t need a novel exploit. They need one leaked OAuth token belonging to a Copilot agent your client’s marketing team stood up three weeks ago.
The four ways AI agents get turned against your clients
Think of this less as an OWASP recitation and more as the threat taxonomy you’ll walk clients through.
1. Credential and token theft. OAuth tokens, AI service API keys, and coding-assistant secrets sitting in developer machines and CI/CD pipelines. Sophos CTO John Peterson: “the threat is in the here and now.” Attackers are actively targeting OAuth tokens, AI service credentials, developer tools, and exposed AI infrastructure.
2. Prompt injection — direct and indirect. OWASP still ranks it the #1 LLM vulnerability and maps it to six of the ten categories in the Top 10 for Agentic Applications. LLMs can’t cleanly separate instructions from data, so hostile text hidden in a web page, PDF, or calendar invite can hijack an agent that reads it. Not theoretical: Help Net Security documented real CVEs across Cursor, Gemini CLI, and ModelScope this year.
3. The “lethal trifecta.” Simon Willison’s shorthand, now baked into OWASP guidance: any agent with (a) private data access, (b) exposure to untrusted content, and (c) the ability to communicate externally is a one-prompt exfiltration tool. Most Copilot Studio flows check all three boxes by default.
4. Supply-chain poisoning of the agent stack. In March 2026, a backdoored LiteLLM — the gateway behind CrewAI, DSPy, Microsoft GraphRAG, and dozens more — sat live on PyPI for three hours. Nearly 47,000 downloads happened in that window. The first malicious MCP server was caught in the wild the same quarter, after fifteen clean releases built its reputation.
Why this hits MSPs harder than most people realize
You know the multi-tenant blast-radius argument from our recent alerts on Warlock’s Zoho Assist abuse and the Arista VeloCloud zero-day. AI agents are worse:
Clients deploy them through shadow channels — Copilot Studio, low-code platforms, browser extensions, personal API keys — bypassing your change management entirely.
Coding agents are the epicenter: n8n has 57 published advisories, Claude Code has 22, and Cursor was hit by CVE-2026-22708, an allowlist-poisoning flaw. If your team uses any of these, you inherit the exposure.
Non-human identities aren’t in your PSA. They spawn other non-human identities. 71% of organizations suffered at least one identity-related breach last year, and weak NHI management added roughly $150,000 per incident to recovery costs.
Translation: client AI adoption is expanding the attack surface faster than your stack is expanding to cover it. That gap is either your liability or your next service line.
What to do this quarter
Group the work into three buckets. Sell it as one engagement.
Discover. Inventory every AI agent, Copilot Studio flow, MCP server, coding assistant, and low-code automation in each client tenant. Enumerate the OAuth grants, API keys, and service accounts each one holds. Assume shadow AI is present — it is.
Contain. Treat AI agents like human users: least privilege, per-tool scoping, no standing admin. Break the lethal trifecta — if an agent reads untrusted content, cut its ability to exfiltrate; if it can exfiltrate, restrict what it can read. Require human approval for consequential actions (send email, export data, change permissions, move money). Replace long-lived credentials with short-lived tokens and enforce phishing-resistant MFA on every account that can provision agents.
Monitor. Deploy Identity Threat Detection and Response (ITDR) tuned for machine-identity behavior. Log every tool call and outbound connection. Alert on unexpected data egress, anomalous OAuth grants, and drift in coding-agent allowlists.
None of this requires a new AI platform. It’s identity governance, least privilege, and supply-chain hygiene — the same disciplines that map cleanly to CIS Controls, NIST CSF 2.0, and the identity requirements in CMMC, HIPAA, and PCI. That framing matters when you price this to a client CFO.
Bottom line
The AI agent attack surface isn’t the model. It’s the identity, the token, and the tool the agent can reach. MSPs that reframe agentic AI as an identity-governance and supply-chain problem turn client anxiety into a productizable service line — before insurers and regulators force the conversation.
Sell the Shadow AI & Non-Human Identity Assessment now. In six months your competitors will be selling it too, probably after their first client incident.
FAQ
Q: What is the biggest AI security risk for small and mid-sized businesses in 2026?
A: Compromise of AI agent identities — the OAuth tokens, API keys, and service accounts that AI agents use to reach data and take action. Sophos’s 2026 research identifies AI identities as the fastest-growing new attack surface, with enterprise AI agent populations up 466.7% year-over-year per BeyondTrust telemetry.
Q: What is prompt injection and why does it matter to my business?
A: Prompt injection is when an attacker hides instructions inside content an AI agent reads — a web page, PDF, email, or calendar invite — and the agent follows them. OWASP has ranked it the #1 LLM vulnerability every year since 2023. It matters because agents don’t just chat; they act, and a successful injection lets attackers use whatever tools the agent has.
Q: What is the “lethal trifecta” in AI agent security?
A: A phrase from researcher Simon Willison, adopted by OWASP. Any AI agent that has (1) access to private data, (2) exposure to untrusted content, and (3) the ability to send data outside the organization can be turned into an exfiltration tool by a single injected prompt. Break any one of the three legs and the risk drops sharply.
Q: How can an MSP inventory shadow AI in a client environment?
A: Start with the identity provider (Entra ID, Okta, Google Workspace) and pull every service principal, OAuth app grant, and API-integrated user. Cross-reference against SaaS admin consoles (Microsoft 365 Copilot, Salesforce, ServiceNow, Google Workspace) and any low-code platforms in use (Copilot Studio, Zapier, n8n, Make). Anything you can’t tie to a documented business owner and purpose is shadow AI.
Q: Does compliance require AI agent governance yet?
A: Directly, not yet in most U.S. frameworks — but the underlying controls do. NIST CSF 2.0, CIS Controls v8.1, CMMC Level 2, HIPAA, and PCI DSS 4.0 all require identity inventory, least privilege, credential rotation, and logging. Every one of those obligations already covers AI agents as non-human identities. The EU AI Act, DORA, and New York’s RAISE Act add explicit AI governance and incident-reporting timelines on top.