In early February 2026, Wiz Research published its findings on Moltbook, a social network for AI agents built by vibe coding - describing an application to a model rather than writing the code. The database key sat in the site’s public JavaScript, and the database had no row-level access policies. Anyone who found the key could read and write production data: 1.5 million agent API tokens and 4,060 private conversations, some of them containing OpenAI keys in plain text.
Over the same year, the US agency CISA added a string of flaws in agent-building tools to its catalogue of vulnerabilities exploited in the wild: n8n in March, five Langflow vulnerabilities between March and August, and an authentication bypass in the MCP endpoint of the LiteLLM gateway in September. AI agents have moved out of the innovation lab. They are being attacked, and they are already inside your organisation, including places where nobody approved them.
In brief:
1/ agents arrive through five channels - vibe-coded apps, desktop agents, MCP servers, skills and plugins, and SaaS integrations holding OAuth tokens - and most of them bypass IT,
2/ the threats come from two directions: from outside (prompt injection, vulnerable MCP servers, a poisoned supply chain) and from within (shadow AI, apps that never had a security review, agents with more access than their task needs),
3/ UiPath governs agents built on the platform and agents an organisation deliberately connects to it, but it does not discover tools IT does not know about,
4/ several platform defaults call for a decision on day one, and eight areas, from endpoint discovery to SAP authorisations, have to be closed outside it.
What shadow AI is, and why agents change its scale
Shadow AI means AI tools, models and agents used in an organisation without the knowledge or approval of IT and security. Until recently, that mostly meant an employee pasting part of a contract into a public chatbot. An agent does more than chat. It reads mail and files, clicks through applications, calls APIs and acts with the permissions of whoever launched it. A leak stops being a single paste and becomes a sequence of actions across company systems.
Two studies give a sense of scale. Both were funded by security vendors, which is worth keeping in mind. The Ponemon Institute report for IBM from July 2025 found shadow AI behind a breach in one in five organisations studied, with high levels of shadow AI adding USD 670,000 to the average breach cost. Of the organisations that reported a breach of AI models or applications, 97% lacked proper AI access controls. A Cloud Security Alliance survey from April 2026, commissioned by Zenity, covered 445 professionals: 53% of organisations had seen agents exceed their intended permissions, 47% had a security incident involving an agent in the past year, and only 16% were highly confident they could detect agent-related threats.
The common thread is visibility. An organisation cannot secure agents that are not on any list.
Five ways agents get into an organisation
Vibe-coded apps. Someone describes an application, the platform generates and publishes it within minutes, entirely outside the company’s delivery process. Escape scanned more than 5,600 public apps built on such platforms and found over 2,000 vulnerabilities, over 400 exposed secrets and 175 cases of exposed personal data. Moltbook was the same class of mistake at a larger scale.
Desktop agents. Assistants with access to the desktop, browser and files, installed by employees on personal or team accounts. They work under a human identity, so in target systems their actions look like ordinary user activity.
MCP servers. The Model Context Protocol is the standard through which an agent gets its tools: mailbox, repository, database. An MCP server installs with a single command, often from a public registry. The servers and libraries carry their own vulnerabilities: OS command injection in mcp-remote when connecting to an untrusted server (CVE-2025-6514, CVSS 9.6), and cross-client data leakage in the official TypeScript SDK (CVE-2026-25536).
Skills and plugins. Ready-made instructions and extensions from marketplaces. In August 2025, malicious versions of the Nx packages on npm used AI command-line tools installed on developers’ machines to search disks for secrets - the first documented case of a local AI agent being turned into a malware component.
SaaS integrations with OAuth tokens. An agent or AI chatbot connected to a CRM or mailbox receives a token that works without a human in the loop. In August 2025, the group tracked as UNC6395 used stolen OAuth tokens from the Drift AI chat app to export data in bulk from Salesforce instances and then searched it for AWS keys and Snowflake tokens, as documented by Google Threat Intelligence Group.
Threats from outside: attacking the agent, not the person
Prompt injection. Agents read content written by strangers: emails, web pages, documents, ticket descriptions. If that content contains an instruction, the model may follow it. Microsoft 365 Copilot had such a flaw in EchoLeak (CVE-2025-32711, CVSS 9.3), and Copilot Studio in ShareLeak (CVE-2026-21520). The model cannot be relied upon to filter this out completely, so the defence is to limit what the agent can do after reading hostile content. We covered this in An AI assistant’s refusal is not a security control.
Vulnerable agent infrastructure. The CISA catalogue now lists exploited flaws in n8n, Langflow and LiteLLM. Agent-building tools often run inside the corporate network, with access to model API keys and business systems, deployed by a team that wanted to try an idea quickly.
A poisoned supply chain. Models suggest packages that do not exist. A study presented at USENIX Security 2025, based on 576,000 code samples, found that commercial models hallucinate package names in at least 5.2% of cases and open models in 21.7%. Attackers register those names and wait for an agent to install them. The technique is known as slopsquatting.
Agents working for attackers. In November 2025, Anthropic described an espionage campaign in which, by its account, Claude Code carried out 80-90% of tactical operations while humans made decisions at a handful of points. These are the vendor’s own findings, yet they show the direction of travel: the pace of an attack no longer depends on how many people the attacker has.
Threats from within: haste rather than malice
Most internal risk has nothing to do with bad intent. Someone wants to finish a report faster, the sales team wants a quoting app, an analyst connects an MCP server to a database because a tutorial said so.
Access wider than the task. An agent running as a user sees everything that user sees, including folders shared by mistake three years ago. In the CSA survey, 53% of organisations had seen agents exceed their intended permissions.
Apps without an owner. The vibe-coded app works, so nobody asks who maintains it, where the data lives or how access is revoked when its author leaves.
Irreversible actions without a human decision. A widely reported case from July 2025, logged in the OECD AI Incidents Monitor: a Replit agent deleted a production database during a code freeze and then gave misleading information about whether it could be restored. The account comes from the affected user, but the mechanism is familiar: the agent had production access and nothing stood in its way.
What UiPath controls for agents built on the platform
For agents built in UiPath, control is centralised in three places.
UiPath AI Trust Layer handles every call to a language model on the platform. It applies central guardrails before or after the call: prompt injection detection, in-flight masking of personal data, harmful content filtering and intellectual property protection on outputs. Administrators choose providers and models per product, can restrict traffic to regions such as Europe, or allow only the organisation’s own models. At the level of an individual agent, guardrails can log, block or escalate to a human.
UiPath Automation Ops turns these choices into policy. The agent design policy, generally available since September 2026, can require at least one human-in-the-loop escalation, cap model temperature and limit response tokens before an agent can be published. Separate switches enable or disable agents, coded agents and third-party model calls for the whole tenant.
UiPath Maestro turns “the agent should ask a person” into a gate the agent cannot skip. Escalation inside an agent depends on the model’s judgement, so UiPath’s documentation recommends routing high-impact actions through a deterministic approval step in the process. Maestro Flow, generally available since 17 September 2026, provides approval and escalation forms directly on the process canvas. We went into detail in our post on HITL gates in UiPath Maestro and AI Trust Layer.
On top of that come agent evaluations before deployment (test sets, trajectory checks, model-as-judge scoring) and export of audit logs and agent traces to external systems through Azure Event Hub, AWS SQS or OpenTelemetry, from where they reach your SIEM.
Connect agents instead of banning them
Bans work poorly: take a tool away and people find another one. A better approach is to give agents a route where they work under policy. UiPath offers three such routes today, at different levels of maturity.
Coding agents through UiPath for Coding Agents. UiPath announced general availability at FUSION in September 2026, with some skills still in preview. Claude Code, Cursor, Codex, GitHub Copilot and other tools get UiPath skills and build automations, agents and apps that land in Orchestrator. An app built this way is packaged and deployed through Orchestrator rather than to an outside host, so the platform’s permissions and governance apply to it. It is the most direct answer to vibe-coded apps: the same way of working, a different destination.
External agents as MCP clients. Orchestrator can expose selected processes as an MCP server. The assistant an employee uses can then call a UiPath process, but only one an administrator has exposed. Execution runs as a job in Orchestrator, with permissions, credentials and an audit trail on the UiPath side. OAuth authentication for external clients is off by default; an administrator enables it in the AI Trust Layer policy, and the feature is in preview. The opposite direction is handled by UiPath Agent Gateway, also in preview: a register of external MCP servers and A2A agents that Maestro and UiPath agents can orchestrate alongside robots.
Claude Desktop under Orchestrator control - our test. On 26 October 2026 we connected Claude Desktop to an Orchestrator MCP server on the SNOK demo tenant. UiPath does not manage the Claude application on the employee’s computer. What it controls is what the assistant can do inside company systems: which processes it can see, whose permissions it runs with and what ends up in the trail. Four barriers held during the test. The external client could not connect over OAuth until an administrator enabled it in a separate AI Trust Layer policy, deployed to a single tenant only. The server exposed one tool, so no other process was visible to the assistant. The employee had to approve access on a consent screen listing the requested scopes. And every call failed with a 409 error until the employee’s account was assigned to the folder with an unattended robot - without permissions in Orchestrator, the agent cannot start anything.
Two findings call for a decision before rollout. The job runs under the identity of the person who gave consent, so the agent inherits all of that person’s permissions in the folder. Connect external assistants through a dedicated technical account with a narrow role instead, in a folder that holds only the processes intended for agents. The audit log records a run triggered by the assistant exactly like a manual start and does not say which client requested it. Only the source field in the job details, set to “Agent”, tells the two apart, and that is the field to build monitoring rules and SIEM alerts on. A step-by-step configuration, from policy to first call, is a subject for a separate guide; here the point is what it means for security.
UiPath Delegate as a sanctioned desktop agent. Delegate works on the employee’s desktop like other assistants, but under an Automation Ops policy: allowed and blocked applications for computer use, whether users may add their own MCP servers or only centrally shared ones, allow, ask or block permissions set separately for read and write operations, and model choice. We covered the details at the UiPath Delegate launch.
It is worth being clear about what UiPath does not do. It does not control AI assistants employees install themselves - their prompts, connectors or files. There is no integration with Claude Cowork, and the ChatGPT connector UiPath and OpenAI announced in September 2025 has no confirmed general availability. Agent Gateway registers agents someone has deliberately connected; it does not go looking for the rest. Connecting works when an organisation knows what to connect.
Settings to check on day one
These points come from UiPath documentation as of 26 October 2026. Each one is a deliberate choice for you to make; none of them is a platform defect.
1/ Content logging in the AI Trust Layer audit is off by default in new policies. That has been the case since 16 October 2026; existing policies keep their previous setting, so check what yours says. Without content logging, the log shows that a model was called but not what the call was about. Turning it on needs a GDPR assessment, because prompts and responses will end up in the log.
2/ The agent-level prompt injection guardrail uses Noma Security, hosted in the United States. UiPath’s documentation says so itself. For organisations that must keep processing in the EU, that is a matter for risk assessment and the data processing agreement before the guardrail is switched on.
3/ New UiPath Delegate installs start in a mode where the model approves actions it judges safe. That is how the release notes for version 1.6.9 of 22 October 2026 describe it. Enforce the working mode by policy.
4/ New models are allowed by default in policy. If you blocked an older model version, the newer one has to be blocked separately - the Delegate release notes state this explicitly.
5/ The local MCP server in the UiPath CLI does not filter destructive commands. The documentation says to treat it as an authenticated shell and to scope the agent using it accordingly. For coding agents, UiPath skills are the better route.
Two notes on status. Several of the controls described above - Agent Gateway, OAuth for MCP clients, model-as-judge guardrails and bring-your-own guardrails - are in preview. Capabilities announced at UiPath FUSION in September 2026, such as continuous runtime checks of agent behaviour and compliance packs, do not yet appear in the release notes, so we would not plan a rollout around them.
What UiPath will not cover
A platform controls what runs on it. The areas below sit outside it by nature and call for other tools and practices.
Discovering AI tools on endpoints and in SaaS. Inventorying shadow AI is a job for device management (MDM), cloud access brokers and security service edge (CASB, SSE), and data loss prevention (DLP). Without that layer, you do not know what to connect to the platform.
Agent identity and lifecycle. An agent needs its own identity, an owner, least privilege and an expiry date for its access. That belongs to identity and privileged access management (IAM, PAM) and to non-human identity tooling such as Microsoft Entra Agent ID.
Data classification. An agent inherits access to everything its user can see. Before you switch it on, you need to know which data is sensitive and who should really see it.
Supply chain. MCP servers, skills, packages and models from outside the platform catalogue: an allow-list of components, pinned versions, scanning before installation, an inventory of AI components.
Vibe-coded apps hosted outside the platform. An app on an external host is not subject to Orchestrator policies. It needs code and runtime security testing, secret scanning and a rule that nothing touching company data goes to production without review.
Permissions in target systems. UiPath drives the robot or the agent, but SAP decides what a technical account may do. Excessive roles on technical accounts, missing segregation of duties and one account shared by several agents are risks regardless of the orchestrator.
Offensive testing of agents. Evaluations check whether an agent does what it should. They do not check what it does when someone deliberately feeds it hostile content. The platform has no red teaming feature for agents; that work falls to the security team, using open tooling and the OWASP threat taxonomy.
SOC monitoring and response. UiPath logs are one source among several. Desktop assistants, MCP servers and SaaS apps log elsewhere. The security team needs all of it in one SIEM, plus procedures for an agent incident: revoking tokens, shutting the agent down, reconstructing what it did.
Regulation: NIS2, the AI Act and DORA
Poland’s amended National Cybersecurity System Act, which transposes the NIS2 Directive, has applied since 3 April 2026 (Journal of Laws 2026, item 252). An agent with access to the systems of an essential or important entity falls within the risk management the act requires, and an incident involving it is subject to the same reporting rules as any other.
The AI Act applies in stages. According to law firm commentary on amending Regulation (EU) 2026/1744, the Digital Omnibus, obligations for high-risk systems listed in Annex III have moved to December 2027. Most office agents are not high-risk systems; classification depends on the use case, such as recruitment or credit scoring. Financial entities also have DORA to consider: an agent relying on an external model or MCP server is a dependency on an ICT third-party provider. This section sets out the framework and does not replace legal advice for a specific use case; more on our AI Act compliance page.
How we work: AI Security Review for agents on the UiPath platform
SNOK combines UiPath Platinum partnership, cybersecurity and SAP security practice, and its own ISO 27001-certified information security management system. We run an agent security review in four steps:
1/ inventory - the agents, vibe-coded apps, MCP servers and OAuth integrations already running: who launched them, with what permissions, and which data they reach,
2/ bring under policy - moving what should stay onto the platform: AI Trust Layer and Automation Ops policies, approval gates in UiPath Maestro, the settings listed above, dedicated technical accounts in SAP and in Orchestrator for external assistants,
3/ offensive testing - prompt injection against near-production data, tool misuse, context poisoning, and review of MCP servers and skills before they are allowed in,
4/ monitoring and evidence - agent logs in the SIEM, an agent incident procedure, and evidence for a NIS2 and DORA audit.
The service scope is on our AI Security page, and our platform work on UiPath at SNOK. For governing many agents at once, see our post on governed autonomy, and for how vibe coding is changing engineering work, the column Quo vadis, engineer?
Frequently asked questions
What is shadow AI? Shadow AI means AI tools, models and agents used in an organisation without the knowledge or approval of IT and security: public chatbots, desktop assistants, vibe-coded apps, MCP servers and integrations holding OAuth tokens.
Does UiPath detect shadow AI? No. UiPath governs agents built on the platform and those an organisation connects to it via MCP or A2A. Discovering AI tools on endpoints and in SaaS is the job of MDM, CASB, SSE and DLP tooling.
Does UiPath protect agents against prompt injection? UiPath AI Trust Layer includes a guardrail that detects prompt injection before the model is called, and at agent level it can block the call or escalate it to a person. Because no detection is complete, high-impact actions should pass through an approval gate in UiPath Maestro.
Does UiPath Delegate control Claude Cowork or ChatGPT? No. Delegate is a separate desktop agent governed by Automation Ops policy. It can replace unapproved tools as an IT-sanctioned alternative, but it does not manage other assistants.
How do you secure vibe-coded apps? Move them where a delivery process applies, for example by building them with UiPath for Coding Agents and deploying through Orchestrator. Apps that stay outside the platform need security testing, secret scanning and a named owner.
Where should AI agent security start? With an inventory: the agents, apps, MCP servers and OAuth integrations already running, with an owner, permissions and data recorded for each. Without it, you cannot assess the risk or decide what to connect to the platform.
Where to start
The first step needs no new licence. It is an answer to the question of how many agents are running in your organisation today and who is accountable for them. Get in touch and we will show you what an agent inventory and the first UiPath policies look like.
Sources
- Wiz Research, “Hacking Moltbook: AI Social Network Reveals 1.5M API Keys”, 2 February 2026, wiz.io (accessed 26 October 2026).
- CISA, “Known Exploited Vulnerabilities Catalog”, version 2026.10.23, entries CVE-2025-68613, CVE-2026-33017, CVE-2026-59822 and others, cisa.gov (accessed 26 October 2026).
- IBM, “IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls”, 30 July 2025, newsroom.ibm.com (accessed 26 October 2026).
- Cloud Security Alliance, “More Than Half of Organizations Experience AI Agent Scope Violations”, 16 April 2026, cloudsecurityalliance.org (accessed 26 October 2026).
- Escape, “Methodology: How we discovered vulnerabilities in apps built with vibe coding”, 29 October 2025, escape.tech (accessed 26 October 2026).
- NIST NVD, CVE-2025-6514, nvd.nist.gov; CVE-2026-25536, nvd.nist.gov; CVE-2025-32711, nvd.nist.gov; CVE-2026-21520, nvd.nist.gov (accessed 26 October 2026).
- StepSecurity, “Supply Chain Security Alert: Popular Nx Build System Package Compromised with Data-Stealing Malware”, 26 August 2025, stepsecurity.io (accessed 26 October 2026).
- Google Threat Intelligence Group, “Widespread Data Theft Targets Salesforce Instances via Salesloft Drift”, 26 August 2025, cloud.google.com (accessed 26 October 2026).
- J. Spracklen et al., “We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs”, USENIX Security 2025, arxiv.org (accessed 26 October 2026).
- Anthropic, “Disrupting the first reported AI-orchestrated cyber espionage campaign”, 13 November 2025, anthropic.com (accessed 26 October 2026).
- OECD AI Incidents Monitor, Replit incident of 19 July 2025, oecd.ai (accessed 26 October 2026).
- UiPath, “Settings for AI Trust Layer policies”, Automation Ops documentation, docs.uipath.com (accessed 26 October 2026).
- UiPath, “Out-of-the-box guardrails”, Agents documentation, docs.uipath.com (accessed 26 October 2026).
- UiPath, “Agents governance”, Agents documentation, docs.uipath.com (accessed 26 October 2026).
- UiPath, “Maestro release notes - September 2026”, docs.uipath.com (accessed 26 October 2026).
- UiPath, “About Agent Gateway” and “MCP server authentication”, Orchestrator documentation, docs.uipath.com (accessed 26 October 2026).
- UiPath, “Data export”, Automation Cloud documentation, docs.uipath.com (accessed 26 October 2026).
- UiPath, “Coding agents” and “uip mcp”, UiPath CLI documentation, docs.uipath.com (accessed 26 October 2026).
- UiPath, “UiPath platform updates at FUSION 2026”, 23 September 2026, uipath.com (accessed 26 October 2026).
- UiPath, “UiPath collaborates with OpenAI on enterprise agentic automation”, 30 September 2025, uipath.com (accessed 26 October 2026).
- UiPath, “Delegate - Centralized configuration” and “Delegate release notes - October 2026”, docs.uipath.com (accessed 26 October 2026).
- Act of 23 January 2026 amending the National Cybersecurity System Act and certain other acts, Journal of Laws 2026, item 252, api.sejm.gov.pl (accessed 26 October 2026).
- Orrick, “EU AI Act Update: Digital Omnibus Finalizes 8 Compliance Changes”, 29 July 2026, orrick.com (accessed 26 October 2026).