# Why Agent Runtime Security Fails Without Foundational Visibility Gateway-only security strategies miss critical risks within third-party AI agent ecosystems. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-11-04 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/14080a9d-dc08-4e70-9039-9ffbb207dcc5 ## The Gateway Fallacy Most agent security pitches promise real-time blocking, yet this only works if traffic passes through an enterprise-owned gateway. Many modern agents operate entirely within third-party platforms like Salesforce or Slack. Relying solely on gateways creates a dangerous blind spot, as these tools cannot inspect actions occurring inside external trust boundaries. ## The Unreachable Skill Gap The OWASP Agentic Skills Top 10 identifies the unreachable skill scenario as a major governance failure. When agents execute tasks inside platforms like Microsoft 365 or Workday, they utilize internal application features and data. External scanners cannot reach these environments, rendering traditional perimeter-based security controls ineffective against unauthorized agent behavior. ## Contextual Decision Making Runtime decisions require more than just observing an action. A support agent pulling customer data might be performing legitimate work or exfiltrating sensitive information. Without understanding the agent's identity, permissions, and the full delegation chain, security systems cannot distinguish between normal activity and a compromise, leading to ineffective, binary blocking. ## The Chain Reaction Risk Security enforcement often evaluates only the final hop of an agent's request. This approach misses the fact that authority may have arrived through an unapproved chain of events. Judging the entire causal path is essential, but this requires a pre-existing map of identity, connectivity, and data sensitivity that gateways lack. ## Lessons from LiteLLM In March 2026, attackers compromised the open-source gateway LiteLLM, exposing over 2,500 organizations. This incident proves that shared security components can become primary attack vectors. Treating a single gateway as the entire strategy concentrates risk, as the failure of that component results in a shared failure across the enterprise. ## Graduated Enforcement Models Mature security requires a graduated response rather than simple blocking. Systems should allow known-good actions, warn users when justification is plausible, and redact data when necessary. High-stakes actions should be routed to humans, while kill switches must be available to revoke grants and preserve audit trails for compromised agents. ## The Four-Level Maturity Test Enterprises can assess their posture using a four-level test: Blind, Inventoried, Governed, and Instrumented. Most organizations currently remain at the blind stage, lacking answers to basic questions about agent population and accountability. Moving to an instrumented state requires placing enforcement directly where agents run, rather than at a single point. ## Strategic Visibility Requirements Effective agent security depends on building a map of identity, permissions, and activity before attempting enforcement. Tools like the Reco Graph demonstrate that analyzing reach rather than configuration is the superior unit of analysis. Organizations must prioritize discovery and posture management to ensure that future enforcement points snap into a known environment. ## Sources covering this story - https://thehackernews.com/2026/11/radio-with-no-radar-why-agent-runtime.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._