Start with where the code actually runs. The model sits in Anthropic's cloud and keeps no state between turns; the harness on the developer's laptop is the component that executes bash, authenticates to third parties and opens MCP connections [6]. A transcript retrieved from the cloud side therefore describes decisions, while the credential use those decisions caused happened on a host the API never touched. The source article states the limit directly: activity logs alone cannot tell you whether an agent's access is legitimate [2].
Endpoint tooling does not close that gap either. Local telemetry surfaces processes, files and configurations no cloud service can see, but it produces evidence rather than a governance model, and it cannot bind an agent's activity to an owner, an intent, a credential or a permission [9]. Combine the cloud transcript with the endpoint sensor and the record of activity is fairly complete, but nothing in either one establishes who authorized it.
The survey figures repay a little arithmetic. In a Token-commissioned Cloud Security Alliance survey of 418 IT and security professionals, 68 percent rated their visibility into AI agents as high [7], and 82 percent had discovered an agent in the previous year that security, IT or governance did not know existed [8]. Those two groups cannot be separate populations. 68 plus 82 is 150, so at least 50 percent of respondents fall in both, roughly 209 of the 418, people who called their visibility high and were surprised anyway [10]. Token Security commissioned that survey, and Token Security also supplied the 68.6 percent local-agent share from its own discovery data [5][7], so both numbers come from a company selling into the gap they describe. This is one article, published by The Hacker News [15].
Enforcement, for now, is the managed-settings record: a JSON file on Mac and Linux, registry records on Windows, taking precedence over global, project and user settings so a baseline applies to every Claude Code session in the organisation [11]. Enterprise-plan customers apply policy through a GUI; everyone else writes the record across endpoints with MDM [12]. The published rule set includes allow and deny lists for specific MCP servers, regexes over bash commands, and disabling skills [13]. Those are host controls that constrain what a harness may attempt, but they say nothing about which tokens, SSH keys and cloud profiles are already sitting on the box, and there is no central console that reconciles local configuration, identity and runtime in one place [14].
This is not an exploited flaw, and there is no CVE, no named actor, no campaign attached to it. What exists is an agent that reads files, runs shell commands and calls MCP tools using whatever credentials the developer already holds [3], now with a documented trail where before August 2026 the native controls saw very little [4]. That trail makes the entitlement review possible, but someone still has to carry it out.
