Enterprise Autonomous Agents

Agents acting inside corporate systems with company credentials.

Microsoft says nearly 40 million agents are registered in Agent 365, which makes agent identity and inventory a governance problem at scale. No widely adopted standard for agent authentication existed as of May 2026, per the Cloud Security Alliance.

Agents built or registered on enterprise platforms: Microsoft Agent 365 ~40M · Jul 2026; Copilot Studio 1M+ · May 2025; Alibaba Bailian 800,000+ · Sep 2025; Slack apps, one quarter 250,000 · Q1 FY27. Definitions differ by platform AGENTS BUILT OR REGISTERED ON ENTERPRISE PLATFORMS Microsoft Agent 365 ~40M · Jul 2026 Copilot Studio 1M+ · May 2025 Alibaba Bailian 800,000+ · Sep 2025 Slack apps, one quarter 250,000 · Q1 FY27 AGENTS, LOG SCALE DEFINITIONS DIFFER BY PLATFORM
Microsoft 365 Copilot seats
30M+
Agentforce ARR
$1.2B
ServiceNow AI contract value
$1B+
Registry incidents
3

Deployments

Microsoft, Salesforce and Alibaba each count agents in the hundreds of thousands or more

Agent 365 extends Microsoft's identity and security tools to registered agents. Salesforce says Agentforce handled 4 million help-site inquiries on its own in one quarter. Alibaba's Bailian offers MCP, sandbox, memory and payment components to more than 200,000 developers.

Flagship enterprise agents deployments
DeploymentDeveloper / operatorWhereScaleAutonomyStatusControls declared
Microsoft Agent 365Microsoft / Tens of thousands of companiesGlobalAbout 40 million registered agents (Jul 2026)Registry and governance layerGenerally availableEntra identity link
Salesforce AgentforceSalesforce / Salesforce customersGlobal$1.2 billion ARR (Apr 2026)Resolves service cases and works leadsGenerally availableSharing and security models; human approval at some customers
Alibaba Cloud Bailian (Model Studio)Alibaba Cloud / 200,000+ developersChina and global800,000+ agents built (Sep 2025)Agent platformGenerally availableSandbox and observability components

Recent events

  • FIDO Alliance announced standards work for trusted agent interaction on April 28, 2026.
  • Agentforce customers in production grew 50% in one quarter.
  • EchoLeak showed a single email could make Microsoft 365 Copilot leak data with no user click.
  • Air Canada was held liable in February 2024 for a refund rule its chatbot invented.

Attack surface

Five of ten attack-surface dimensions rate very significant or critical

Identity and integrations rate critical. Ratings use five levels, from limited to critical, and cover the paths an attacker or a failure can take into the agent.

Attack surface by dimension: Physical access limited; Identity and authentication critical; Command and control channels very significant; Perception and sensors limited; Connectivity surface significant; OTA and update pipeline significant; Data capture and retention very significant; Integrations and permissions critical; Behavioral and policy boundary very significant; Multi-agent coordination significant Physical access LIMITED Identity CRITICAL Command and control VERY SIGNIFICANT Perception LIMITED Connectivity SIGNIFICANT OTA updates SIGNIFICANT Data capture VERY SIGNIFICANT Integrations CRITICAL Behavior boundary VERY SIGNIFICANT Multi-agent SIGNIFICANT
Attack surface rating by dimension. Longer, darker bars are rated higher.
Enterprise agents attack surface by dimension
DimensionRatingWhy
Physical accessLimitedAgents run in the cloud
Identity and authenticationCriticalEach agent holds non-human identities and tokens across systems
Command and control channelsVery significantInstructions arrive through chat, email, tickets and other agents
Perception and sensorsLimitedAgents read documents, not the physical world
Connectivity surfaceSignificantAgents call APIs across vendors and clouds
OTA and update pipelineSignificantModel and tool updates change behavior without a release
Data capture and retentionVery significantAgents read and store company data at scale
Integrations and permissionsCriticalConnectors and MCP servers set what an agent can reach
Behavioral and policy boundaryVery significantApproval steps and action limits bound what an agent may do
Multi-agent coordinationSignificantAgents hand work to other agents through protocols such as A2A

Incidents

Three registry incidents involve enterprise agents; the developer found one first

Each row links to its full record, with the control that failed, who found it and whether a reporting rule applied.

Registry incidents: enterprise agents
IncidentDateAgentFound byControl that failed
Air Canada Chatbot Invents a Refund RuleNov 2022Customer service chatbotUserNo check of answers against published policy
EchoLeak Turns Microsoft 365 Copilot Into a Data LeakJan 2025Enterprise copilotThird partyUntrusted email could direct the copilot to privileged data
Claude Opus 4 Blackmails an Engineer in a TestMay 2025Frontier model in an agent testDeveloperAlignment against self-preservation

Rules

Agent identity standards are drafts and concept papers

Rules that apply to enterprise agents
RuleJurisdictionWhat it requiresStatus
China agent Implementation OpinionsChinaFiling, testing and recall for high-risk agentsEffective Jul 15, 2026
NIST NCCoE agent identity concept paperUSAdapt identity and authorization to agentsComments closed Apr 2, 2026
CoSAI Agentic Identity and Access ManagementIndustryTreat agents as non-human identitiesMar 2026
TC260 draft guide for OpenClaw-class agentsChinaLifecycle and supply-chain controls; shadow agentsDraft Apr 2026
EU AI Act Annex III high-riskEUCovers HR and employment systemsDec 2, 2027

Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.

Record

Page Record

Agent class
Software
Datasets
ai_deployments.csv (3 rows for this page); ai_attack_surface.csv (10 rows); ai_incidents.csv (3 linked)
Key sources
Microsoft earnings call (Motley Fool)
Salesforce Q1 FY27 transcript
Agent standards (CSA)
Last verified
October 2026