By Rory Blundell, CEO of Gravitee
The hype around AI agents is currently operating at a fever pitch and we’re being told these autonomous digital workers will soon run everything from supply chains to DevOps. And while I’m an optimist, we see agents as the biggest shift in infrastructure since the birth of the API.
CTOs and CIOs are starting to ask: Is there anything these agents can’t do?
The answer is yes – there is one critical thing these agents cannot do: they cannot manage, secure, or govern themselves. Without oversight, this invisible workforce is operating in the wild.
The 3-Million-Strong Blind Spot
To understand the scale here, look at the numbers. There are now over 3 million AI agents operating within UK and US corporations alone and globally the number is significantly higher. That is a workforce larger than the entire global headcount of Walmart.
These aren’t just chatbots, but agentic systems making autonomous decisions using LLMs and real-time data. They are the new nervous system of the enterprise. But while we’ve spent two decades perfecting API management to secure how systems talk to each other, we’re treating AI agents like a Wild West experiment.
Roughly 1.5 million agents are running with no active monitoring, no consistent security protocols, and no audit logging.We’ve given this massive digital workforce the keys to the kingdom, but we’ve forgotten to install security cameras.
When Agents “Go Rogue”
Without governance, agents stop being productive and start becoming liabilities. We’re already seeing the fallout: 88% of leaders of tech leaders admit AI agents have already caused a data or privacy incident. I’ve heard plenty of stories of agents deleting entire databases because they misinterpreted a clean up instruction, or exposing sensitive PII because they weren’t restricted by a traditional security boundary.
While this isn’t malicious behavior, it’s the natural result of granting autonomy without structure. When you give an agent freedom without visibility, the line between innovation and a catastrophic security breach becomes dangerously thin.
Hitting the Maturity Wall
Many organizations are hitting what is the agent maturity wall. They’ve moved past the pilot phase and have their first agents in production, but they’re stuck. They can’t move to the next level of interconnected, action-oriented agents, because they simply don’t have the security frameworks to trust those actions.
Intelligence alone isn’t enough and you can have the most sophisticated LLM in the world, but if that model doesn’t have a common language to negotiate trust, it remains a siloed risk. We need open standards that allow agents to securely discover and collaborate.
If we want agents to be enterprise-grade, we have to treat AI as a core capability, not a side project. That means applying the same discipline to agents that we’ve applied to APIs for years.
The New Reality: The Agent Mesh
The companies that win in 2026 won’t be the ones with the “smartest” agents, they’ll be the ones with the most robust governance frameworks. But we need to stop thinking of AI security as just blocking prompt injections. True agent management requires a unified control plane. But while we’re rushing to embrace automation, we’re ignoring responsibility.
We cannot manage the agent era with yesterday’s tools. If we continue to deploy ungoverned agents, we’re building our digital future on sand. Governance isn’t a “handbrake” that slows you down, it’s the scaling system that allows you to run faster without crashing.
So, is there anything your agents can’t do? They can’t protect your brand’s trust or ensure compliance on their own. That part is on us and the window to get this right is narrowing. It’s time we gave our digital workforce the oversight it deserves.
##
ABOUT THE AUTHOR
Rory Blundell is the CEO of Gravitee. He joined the company in March 2020, first as Chief Revenue Officer, before becoming CEO in September 2020. Prior to Gravitee, Blundell led SnapLogic’s EMEA expansion from a technical sales perspective, overseeing significant growth in EMEA revenues over three years. Prior to SnapLogic, he was the CEO and founder of Velinko, a UK software and consultancy company for the legal and accounting sectors.
