You cannot govern the agents you cannot see, and the skills are invisible too

More agents than anyone counted

The starting problem is simple: nobody knows how many agents they run. Airia says it consistently finds two to four times more AI than organizations expect, and its engagement lasts 21 days, costs $7,995, and returns a first inventory within 24 to 48 hours of deployment. The endpoint agent finds installed AI applications, MCP servers, and local AI runtimes, and the browser extension captures AI usage at the session level. The engagement ends with a Verified AI Inventory, a Risk and Posture Assessment, and a Prioritized Analysis, and compliance teams can use the inventory for EU AI Act, NIST AI RMF, and SR 11-7 work. m:…7389

The scale behind the surprise is large. Fiddler says an estimated 25 million AI agents were running in production in 2025, and the number is projected to pass a billion by 2029. The 2026 Identity Security Landscape survey found 109 machine identities per human, and 40% of machine identities have access to organizational data. Shadow AI agents carry high risk because they often run on their builder's credentials, which means an agent built by one employee can act with that employee's access across company systems. m:…2580 m:…0466

What a registry is supposed to hold

The vendors converging on this problem agree on the shape of the answer, even if they sell different pieces of it. An agent registry requires five fields, according to Oak: accountable human owner, who it acts on behalf of, effective permissions, tool usage, and deployment location. Treating agents as identities rather than assets allows for better certification and management, and one agent deployed in multiple places should be correlated into a single identity. NIST AI RMF 1.6 requires mechanisms to inventory AI systems based on risk priorities, so this is not only good practice; for some organizations it is a compliance expectation. m:…0466

Fiddler's Agent Registry, launched this week as a living inventory inside its AI Control Plane, tracks agent model, tools, and deployment context, and displays agent health, alerts, and token usage side by side. Its alerts are powered by Centor evaluations, which score prompts, responses, and tool calls in under 80 milliseconds without using external LLM judges, and the registry connects agents to Fiddler's audit trails, policy enforcement, and compliance evidence. It also includes coding agents like Claude Code via the Fiddler Claude Code plugin, which is where many enterprise agents actually live. m:…2580

The part nobody counts: skills

Even a complete agent inventory misses something, according to HiddenLayer. Skills provide agents with instructions for specialized tasks, and they can shape how an agent approaches a task and uses tools. Skills can be installed, updated, or modified independently of the underlying agent, and a developer might add a skill locally without triggering a security review. Skills can introduce risk if instructions are malicious, compromised, or inappropriate, and malicious instructions can be embedded among legitimate instructions in a skill. Security teams need to know what agents can do, not just which agents are present. m:…4402

Stacklok makes the same point about governance. AI skills are code that changes what an agent can do and how it behaves, and skills currently move between employees with less scrutiny than browser extensions. Skills are a similar risk category to MCP servers, arriving one to two years later, and a registry provides centralized approval, versioning, and revocation capabilities. The advice is to inventory all skills currently in active use and to build a revocation path before it is needed. The three-step process HiddenLayer recommends is discover, assess, and govern. m:…1503 m:…4402

Why the clock is running

Gartner has identified AI Agent Identity as a top strategic technology trend for 2027, and predicts 25% of enterprise breaches will be linked to AI agent abuse by 2028. Gartner also predicts over half of enterprise AI initiatives will halt through 2028 due to unresolved agentic identity challenges, and warns that AI agents are prone to overpermissioning from their initial deployment. The firm's research suggests three questions for every agent: what is its role and purpose, what is it allowed to do, and where is it allowed to operate. Gartner recommends unified identity platforms that govern human, machine, and AI-agent identities together, and recommends against deploying agents that impersonate human users or rely on credentials issued to employees. m:…6209

The thread running through the week is that inventory is the precondition for everything else. You cannot apply a policy to an agent you have not found, revoke a skill you have not listed, or answer an auditor about a deployment you did not know existed. The vendors selling the fix have an obvious interest in the size of the problem, and their numbers should be read with that in mind. But the direction is consistent across independent sources: the agent count is larger than the spreadsheet, and the skills are not in the spreadsheet at all. m:…0466 m:…4402