A report tells that many AI agents work with no name for customers

On 11 November 2026, Cequence Security, a company that makes tools that make apps safe, wrote a report with KPMG in Singapore. The report tells that agents at this time work for customers, and many do not tell that they are agents. The data come from the research team of Cequence, the company that wrote the report.

How it works

The report tells each company to give each agent one task with hard limits. A control that is not part of the agent must check each step. It can let a step go, send it to a person, or stop it. If it stops a step, it must show the agent the approved procedure.

The numbers

• At a large phone company, requests from agents with no name increased from 100 to 32,000 a day in three weeks.
• Multi-factor checks did not stop them from the accounts of the customer.
• At one online marketplace, more visits used the name Google-Agent than all correct agent visits.
• All did not get in. Cequence tells that attackers made a test of stolen passwords, and Google was not part of it.

What is not known

The report gives no data on how frequently agents cause damage. It gives no test of its control method.

Insight: The check point moves to the app owner

The Securities and Futures Commission of Hong Kong tells that a person cannot check each middle step. It wants a person in charge of the task. Cequence tells that an external control must check each step, for agents that a customer sends. This reads as a move of the check point to the app owner, not the agent maker. Companies that make such checks look to get more control. Look for rules on this layer.