Topic starter
25/10/2026 11:10 am
TL;DR: Personal agents running in vendor-controlled cloud environments leave EDR blind to most activity, according to Manifold Security. Governance has to shift to delegated access, connector scope and retained data if security teams want to see what still persists after revocation.
Editorial analysis by NHI Mgmt Group, based on content published by Manifold Security: “Personal agents live in iMessage and WhatsApp. Your EDR doesn’t.”.
Key questions
Q: Why do delegated OAuth grants make personal agents a security risk?
A: OAuth grants give an agent the same practical reach a user has in mail, storage and collaboration systems, but at machine speed and without the same human friction.
Q: What signs show that personal agents are exceeding intended access?
A: Look for unexpected forwarding to agent-owned domains, mailbox summaries appearing after revocation, unexplained connector expansion and actions that were not explicitly approved by the user.
Q: What breaks when personal agents run in vendor cloud instead of on endpoints?
A: Endpoint-based detection breaks down because the process, browser session and storage often sit in infrastructure the organisation does not control.
Practitioner guidance
- Restrict third-party OAuth consent for agent use Limit Gmail, Outlook, Drive and Slack scopes to approved apps, and require explicit review for any personal agent that requests broad mailbox or file access.
- Audit managed Macs for agent-facing permissions Check screen recording, accessibility and other high-risk permissions on managed macOS devices where agent apps or companion components may operate locally.
- Monitor forwarding to agent-owned domains Detect mailbox forwarding, auto-copying and similar mail flow changes that move corporate content into agent-controlled storage or vendor-hosted mailboxes.
Bottom line: Personal agents change the security boundary by moving execution into vendor-controlled cloud environments that endpoint tools cannot fully see.
Glossary terms: Personal Agent, Delegated Access, Connector Sprawl, Retention Gap
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:18 pm
Personal agents create a visibility inversion: defenders lose the device-centric telemetry they rely on precisely when identity-based access becomes more important. When execution shifts into vendor cloud infrastructure, local controls no longer show the full action chain and the security team is left governing consent, scope and retention instead. The practical conclusion is that endpoint monitoring must be supplemented by identity and connector governance.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations allow personal agents to access work email and files?
A: Only if the organisation can restrict scope, audit delegated access, and enforce deletion and retention rules after revocation. If those controls are not in place, work accounts should stay off personal agents. The decision is less about the agent's usefulness and more about whether the identity and data lifecycle can be governed end to end.
👉 Read our full editorial: Personal agents shift security visibility from endpoint to vendor cloud
This post was modified 7 days ago by NHI Mgmt Group