Local AI agents account for 68.6% of all AI agents discovered in customer environments, and they routinely inherit employee credentials, network access, and permissions, according to a security analysis published by The Hacker News on August 31, 2026. The report examines Anthropic's newly released Compliance API endpoints for Claude Code, which give security teams visibility into agent activity on developer machines for the first time. While the new tools represent a significant step forward, the analysis warns that activity logs alone can't determine whether an agent's access is legitimate.
In a survey commissioned by Token Security and conducted by the Cloud Security Alliance, 68% of 418 IT and security professionals rated their visibility into AI agents as high, yet 82% had discovered an agent in the past year that security, IT, or governance teams didn't know existed. Token Security's research finds an average of more than 10 configuration files per local agent scattered across endpoints. Roughly 35.1% of MCP servers the company discovers are community-built or of unknown origin, operating outside the vendor ecosystem. Claude Code stores all session history locally for 30 days by default, creating another potential exposure point if an attacker gains endpoint access.
On August 11, 2026, Anthropic introduced new endpoints for local sessions that return session metadata and full transcripts of agent activity. The report notes that whatever is communicated to the model is logged in three block types—text, tool_use, and tool_result—covering user prompts, bash commands, file reads and writes, and MCP commands. According to the analysis, parsed correctly, session transcripts allow teams to log tool usage and build an inventory of each agent's skills, MCP servers, and plugins. The authors point out a critical limitation: "If you run Claude Code on a model that isn't Anthropic's, you get no Compliance API coverage at all," meaning sessions on Bedrock, Foundry, or Google Cloud won't be logged.
The analysis explains that Claude Code's architecture creates a fundamental visibility challenge because execution happens locally rather than in a centralized cloud console. The report describes the system as a "weird hybrid" where the LLM brain runs in Anthropic's cloud but the harness—which actually runs commands, authenticates to third parties, and connects to MCP servers—operates on endpoints. Managed settings, session transcripts, and endpoint collection together provide better governance, the authors write, but all three still fall short because none capture the context of the enterprise. An admin reviewing transcripts can't distinguish between a malicious plugin pulled from the internet and a legitimate one written by an engineer without correlating the skills and plugins running on endpoints with those the organization's internal repositories actually manage.
The report recommends starting with responsible use policies: keep users from writing raw secrets into sessions, label projects containing customer or sensitive data, and delete them on a schedule. It then advises adding detection and response capabilities to find user prompts with cleartext secrets and act on sessions that could compromise customer data. The authors conclude that telemetry shows what happened, but governance requires connecting those signals to an agent's owner, purpose, identities, credentials, permissions, and access paths—context that makes it possible to determine whether access is justified, right-size it to least privilege, and revoke it when the agent's purpose ends. Organizations that discover a single malicious skill can use cross-organizational context to generate a heat map of where it runs and move quickly to mitigate. The compliance layer Anthropic has built addresses an urgent need, but teams will still need to bridge the gap between what agents do and whether they should be doing it at all.