Enterprises are running thousands of AI agents. Few can say who's watching them
UBS's third-quarter 2026 results, published October 29, included a line that would have sounded exotic two years ago and now reads like routine infrastructure reporting: employees at the bank are running more than 12,700 personal AI agents in their daily work, and 608 of the bank's AI use cases are now live in production — up 81% from a year earlier, with another 1,090-plus applications still in development. That is not a pilot program. That is an operating system.
The number matters less on its own than as a marker of where enterprise AI has actually gotten to. For most of 2026, boardroom debate about agentic AI centered on whether agents worked reliably enough to deploy. UBS's figures suggest that argument has already been settled inside at least one systemically important bank — and that the harder question now is who, or what, is keeping track of several hundred semi-autonomous processes acting inside a regulated institution's systems. A Gartner estimate cited by IBM at its TechXchange conference on October 27 puts a number on how fast that tracking problem will grow: the average Fortune 500 company is projected to run more than 150,000 AI agents by 2028, and only 13% of organizations currently believe they have adequate governance to manage agents at that scale.
Giving agents a paper trail
Machine.net covered the bones of IBM's response when it broke on October 27, as a contrast point in SK Telecom's AI governance report: HashiCorp Vault 2.2's new Agent Identity capability gives every agent an authoritative record of who owns it, what lifecycle stage it's in, and what authority it has been granted, enforced through Vault's existing secrets-management plumbing so access can be revoked the moment an agent does something it shouldn't. Two pieces of that announcement didn't get space in that first pass and are worth dwelling on here: a companion Secure Hub, still in preview, that gives security teams one place to see usage and health across Vault environments instead of per-team silos, and an upgrade to Watsonx Orchestrate that lets it discover agents built on Amazon Bedrock, Microsoft Foundry and Google Gemini — an acknowledgment that most large enterprises are running agents across several vendors' stacks at once, not standardizing on one.
The list of companies IBM named as existing Vault customers managing non-human identities is itself worth reading: ABN AMRO, BBVA, Target, Starbucks, Adobe, BlackRock, Expedia, Duke Energy, the London Stock Exchange, Canva and Swiss Federal Railways. These are banks, retailers and infrastructure operators — exactly the categories of company, like UBS, that run high-volume customer-facing or operationally critical systems where an unsupervised agent can do the most damage the fastest. It's a tell about where agent-identity spending is actually concentrated: not among AI-native startups, but among large, regulated incumbents whose compliance obligations were already forcing them to think about non-human access control before "agent" was a line item on anyone's budget.
The cost of getting there late
What that governance gap looks like in practice showed up almost simultaneously. On October 30, Chainalysis — the blockchain-analytics firm used by banks, exchanges and governments to track illicit crypto flows — disclosed that an external actor had gained unauthorized access to its systems using what the company called "offensive agentic techniques." Customer names, email addresses, user IDs and organizational role labels were exposed; Chainalysis said its investigation had so far found no evidence that passwords, MFA secrets or session tokens were taken — a preliminary finding from an investigation the company described as ongoing — and that the incident was unrelated to a separate, recent crypto theft involving Binance.
Chainalysis didn't explain what made its attacker's methods "agentic" rather than simply automated, and that vagueness is itself worth noting: vendors are now reaching for AI-attack language in breach disclosures before they can substantiate exactly how AI was involved. For enterprise security buyers, that ambiguity cuts both ways. It's a reason to discount any single breach's agentic framing on its own — and a reason the IBM pitch lands at a useful moment, since "who can see what an agent touched" is precisely the question a vaguely described agentic intrusion leaves unanswered.
What it means for buyers
Put together, the three data points describe one problem rather than three. UBS shows deployment has already reached a scale — thousands of live agents, each needing credentials, permissions and an owner — that manual tracking cannot realistically cover. IBM's announcement, and the Gartner number behind it, show the vendor response arriving at a scale mismatched to the problem: 150,000 agents per Fortune 500 company by 2028 is not a future that today's identity teams, only 13% of whom feel ready, are provisioned for. And Chainalysis shows what decision-makers are actually worried will happen in the gap between those two numbers, whether or not this particular breach turns out to be agent-driven once the investigation concludes.
The practical takeaway for anyone running an enterprise AI program is that identity and governance tooling is becoming as unavoidable a procurement line as the agents themselves — and that most of the companies furthest along, judging by IBM's customer list, got there by retrofitting existing secrets-management infrastructure rather than designing agent identity in from the start. For organizations still in the early stages of scaling agents, that's the lesson UBS's 81% year-over-year production growth makes concrete: the agent count will outrun the org chart that's supposed to supervise it well before anyone decides to build the supervision layer on purpose.