Research published in the period found that AI agents in corporate use frequently reach data nobody explicitly approved, because they inherit the permissions of whoever configured them instead of receiving their own scope.
The mechanism is mundane, which is why it goes unnoticed. Someone with broad access installs an assistant to automate a task, and the assistant starts seeing everything that person sees, including what has nothing to do with the task.
The difference from an employee with broad access is scale and speed. A person reads what they need; an agent sweeps what it can reach, and that sweep may end up in a summary, a search index, or context sent to an external service.
The pattern explains why security companies shipped per-action authorisation and agent identity governance products in the same period.
The fix requires no new product: giving the agent its own identity, with an explicit list of what it may reach, resolves most cases and is auditable afterwards.