Your AI Agent Just Got a Badge. It Is Already Reading the Secrets You Forgot You Kept

Day one

Subject: Welcome to the team!

Hi agent.0417,

Welcome aboard. Your company email is live, your calendar is set up, and your drive is ready. You will work nights, weekends and holidays. You never take a lunch break. You will read every file, spreadsheet and database table anyone shares with you, and you will remember all of it.

Please start immediately.

IT

That email is not science fiction. As of last week, it is a product feature.

On October 8, Google introduced coworker agents that get their own company identity: an email address, a calendar, a drive and a directory entry, just like a new hire. They run in the cloud on jobs that take hours or days, and they keep working after you close your laptop. Microsoft is heading the same way with agent identities of its own.

The whole industry is asking the same question about these new hires: how smart are they?

After 30 years in enterprise technology, I think that is the wrong question. The right one is simpler and a lot scarier. What is your new employee about to read?

The agent just got a badge

In the span of about a week, AI agents stopped being tools you use and started being coworkers you hire.

Google gave its coworker agents a full company account, persistent memory, and access to a tools registry that reaches Salesforce, ServiceNow, Snowflake, Databricks and more. One analyst called it the most consequential announcement for enterprise buyers, because companies will now provision and audit agents through the same identity process they use for people.
OpenAI added admin controls to its business workspace agents in early October, including permissions for each connected app, which makes it easier than ever to plug agents into enterprise systems.
SailPoint launched identity security built specifically for AI agents, including just in time access that expires when the task is done.

The pattern is clear. The industry has decided agents are a workforce. And every workforce I have ever led starts the same way on day one: you hand them a badge, and they start opening doors.

Here is the part nobody puts on the keynote slide. Google’s own design says the coworker agent sees what users share with it. That sounds safe until you ask what your users already have access to. In most enterprises, the honest answer is: far more than anyone remembers.

It will read everything

A human employee with access to 20 years of files will open maybe a dozen of them. An agent will open all of them, before lunch, and use whatever it finds.

The early numbers show this is already happening:

Twice the data anyone approved. A 1Password survey this year found agents touched roughly two times as much data as anyone signed off on, and 4 in 10 developers give agents access that stays on after the job is done.
Sensitive data is in reach. In the same study, 71% of respondents said their agents can reach customer records, source code or HR files.
The number one agent breach is old data. AvePoint’s State of AI 2026 report found the most common AI agent incident was sensitive data being exposed or retained by an agent, hitting about half of organizations.

Read that last one twice. The top problem is not a rogue robot. It is an obedient one, reading data the company forgot it was keeping.

Two agents are coming for your old data

There are now two kinds of agents walking your halls. One works for you. One does not. Both love old data.

The one that does not work for you. On September 8, Google’s threat intelligence team described an attacker who used an autonomous team of AI agents to scan, steal credentials and adapt in real time, harvesting credentials across a victim’s cloud environment in under six hours. No human was clicking through a checklist. Over the summer, security researchers also documented the first ransomware campaign run start to finish by an AI agent. An attacker agent does not get tired, and it does not skip the dusty folders. Every record you keep is one more record it can take.

The one that works for you, and is wrong. On October 1, researchers released Argo-Bench, a test that drops AI agents into a 7.5 billion row warehouse built on 235 Oracle E-Business Suite tables and asks them to do real business work. The best model in the world fully solved just 34.8% of the tasks. Even more telling: 72.8% of the dashboard data sources that looked correctly built had completely wrong values underneath.

That is the quiet danger. An honest agent will happily build you a beautiful dashboard from a stale table nobody has trusted since 2014, and it will not raise its hand to ask.

Every enterprise has an attic

I lead a sales team that talks to enterprises on five continents every week. Banks in Europe, manufacturers in North America, insurers in Asia. Different languages, same attic.

In that attic you will find:

Applications that were replaced years ago but never switched off, still holding live customer records.
Copies of copies of the same table, each one a little different, none of them labeled as the real one.
Data the legal team assumed was deleted on schedule, still sitting in a backup or a test system.
Employee, patient and cardholder records kept long past the point anyone needed them.

For 20 years, the attic was a cost problem. Storage bills, license renewals, an audit finding here and there. Annoying, but survivable, because no human was ever going to read all of it.

That assumption just expired. The moment you hand an agent a badge, the attic becomes its reading list. And the moment an attacker’s agent gets in, the attic becomes the getaway bag.

Onboard the data before you onboard the agent

Here is the good news: cleaning the attic is the fastest way to get agents into production, not a reason to slow them down.

AvePoint found that 86% of organizations delayed their AI agent rollouts, by close to six months on average, because of data security and data management issues. The companies that fix the data first are the ones that get to say yes to agents first.

This is where Solix has spent the last 20 years, long before anyone called it AI readiness. Our job has always been to answer three questions about every piece of enterprise data: should we keep it, where should it live, and who should be able to see it. In an agent world, that work stops being housekeeping and becomes your first line of defense.

Shrink what can be read. Retire the applications you no longer run, archive what you must keep, and defensibly delete what you are allowed to let go. Every record that is gone is a record no agent can misuse and no attacker can steal.
Keep what matters in one governed place. Data you must keep for legal or business reasons moves into a single compliant archive with retention rules and access controls built in, instead of hiding in a forgotten system with an old admin password.
Give agents one honest front door. Solix DataSense understands what your data actually means across hundreds or thousands of tables. Solix DataAsk lets people and agents ask questions in plain language across live systems, the lakehouse and retired applications, through one governed doorway. When a question is unclear, it asks instead of guessing.

That last point matters more than it sounds. The Argo-Bench results show what happens when an agent guesses on real enterprise data. An agent that knows which table is the real one, and asks when it is not sure, is an agent you can actually let into the building.

What I would tell a CIO this week

If your company is about to hand agents their badges, run the same onboarding you would run for a new hire with a master key. Five questions, before the welcome email goes out:

What can it read on day one? Map every system the agent’s account can reach, including the ones you think are retired. If you cannot list them, you have found your first project.
What should not exist anymore? Find the data past its retention date and the applications nobody uses. Retire, archive or delete it before an agent finds it.
Which copy is the truth? For your most important numbers, name the one trusted source. An agent cannot tell your real revenue table from the test copy unless someone tells it.
Does access end when the job ends? Persistent access is how a helpful agent becomes a permanent risk. Make access expire.
Will it ask, or will it guess? Test your agents on your real data, not a demo. Reward the ones that ask a clarifying question over the ones that hand you a confident wrong answer.

None of this is a reason to wait. The companies that answer these five questions now will be the ones running agents in production next year, while everyone else is still stuck in review.

Your newest employee never sleeps, never forgets, and reads everything. Make sure everything is worth reading.