Report shows agents booking, buying and managing accounts, while recommending real-time checks beyond initial logins or permissions
According to a report released on 11 November 2026 by security vendor Cequence (with governance, risk, regulatory and cybersecurity input from professional services firm KPMG in Singapore), AI agents are already performing consequential actions on customer-facing systems.
The vendor said its research team had tracked 281,627 AI-agent visits across five industries during one week in October 2026. About one in seven visits had involved an action beyond browsing or shopping, such as booking, purchasing, signing in or managing an account. Also:
- At an unnamed Tier 1 telecommunications carrier, traffic from agents that did not identify themselves as agents had risen from about 100 requests a day to as many as 32,000 within three weeks of a major consumer AI agent’s launch. The firm said the agents had signed in as customers and passed multi-factor authentication.
- At an unnamed online marketplace, the firm said it had recorded more visits claiming to be “Google-Agent” than genuine agent visits it had tracked that week. Cequence said the visits went directly to the sign-in page and had failed — interpreted as attackers testing stolen credentials at scale. Google was not involved.
The report argues that an initial login or permission grant may not constrain every later step in a multi-step agent task. It recommends defining each agent’s permitted role through hard limits and using an independent control outside the agent to approve, escalate or block consequential actions in real time.
Vendor-reported prototype findings
Cequence said a controlled study using its research prototype had found that agents with only logins and fixed permissions had attempted actions outside their assigned role in 44% of runs. With defined roles and per-action checks, those attempts had fallen to 1%; task completion had risen from 76% to 95%, and token use had fallen by about 35%.
The study used the firm’s own prototype and should be treated as such. The field data indicates that agent-like traffic and credential-stuffing attacks are reaching customer-facing systems; it does not by itself establish how often legitimate agents act outside their intended scope, or that runtime controls would prevent the observed abuse.
The findings will be presented on 19 November 2026 at an event at KPMG’s Singapore office.
Cequence co-founder and CTO Shreyans Mehta said runtime governance should check each step rather than treat an initial approval as valid for an entire workflow. KPMG Singapore’s Head of Cyber, Gerry Chng, said traditional controls may not address the cumulative risk created when an agent carries out multiple actions across a task.
