Authority, not approval — 18,000 agents on the endpoints, 300 on the list, and the deployer definition never asked

Discovery did not create an AI estate; it produced the first accurate record of one that already existed. AI Act Article 3(4) makes an organisation the deployer of every AI system used under its authority, with no approval step in the test, so the 17,700 agents nobody signed off were already carrying deployer duties before anyone counted them. The duties that bite today are Article 4 AI literacy, in force since 2 February 2025 and impossible to scope against a register that is 1.7 per cent complete, and the 2 December 2026 marking clock under Article 50 — not the Annex III deployer chapter, which the Digital Omnibus moved to 2 December 2027. The practitioner move is to write the register before buying the scanner, add a column for whether an agent's output reaches anyone outside the company, and scope AI literacy from the register rather than from procurement.

Post

A Fortune 500 company switched on AI-agent discovery in August and found 18,000 agents running on its endpoints.

It had approved 300.

Michael Sentonas, CrowdStrike's president, said it from the stage in the day-two keynote at Fal.Con on 2 September. Worth knowing the provenance: the product's launch materials carry no count at all, VentureBeat carried the line on 8 September, and the customer is unnamed. Read it as a vendor's account of a vendor's tool and it still lands, because the shape is the point — 59 unapproved agents for every one on the list.

Three things before you file this under shadow IT.

  1. Deployer status has no approval step. AI Act Article 3(4) defines a deployer as anyone "using an AI system under its authority" — authority, not authorisation. Managed endpoints, corporate identity, company credentials. All 18,000 were under that authority on 31 July, before anyone counted them.

  2. The heavy deployer duties are not the live clock. The Digital Omnibus, Regulation (EU) 2026/1744, in force 27 July, moved Annex III high-risk to 2 December 2027. What already applies is Article 4: providers and deployers must support AI literacy for staff "and other persons dealing with the operation and use of AI systems on their behalf", in force since 2 February 2025. You cannot scope that against a register that is 1.7% complete.

  3. The near clock is 2 December 2026. Article 50 has applied since 2 August; machine-readable marking of generated content lands on 2 December. Marking is a provider duty — and the moment your team wires an agent into something you put into service under your own name, that is you. You cannot answer that without knowing which of the 18,000 emit content.

Monday:

  1. Write the register before you buy the scanner: per agent, owner, purpose, what data it touches.
  2. Add one column — does anything it produces reach a person outside the company? That is your 2 December list.
  3. Scope AI literacy from the register, not from procurement.
  4. In Germany, questions and complaints go to the BNetzA — central point under the KI-MIG since 29 July, and market surveillance for AI in sensitive sectors.

Your approved list tells you what you meant to run. Your endpoints tell you what you are the deployer of.

What is actually running on yours?

#EUAIAct #AgenticAI #AIGovernance #CISO #AICompliance

First comment

Sources, in the order they carry the argument.

The Fal.Con day-two transcript, 2 September 2026 — Sentonas's line verbatim, and Adam Meyers on agentic adversaries: https://www.investing.com/news/transcripts/crowdstrike-at-falcon-day-2-ai-security-takes-center-stage-93CH-4886599

VentureBeat's write-up, 8 September 2026 — the same figure, plus their own enterprise tracker: 18% of 116 enterprises isolate their highest-risk agents, 8% pair enforcement with isolation: https://venturebeat.com/security/most-security-teams-dont-know-how-many-ai-agents-theyre-running-falcon-guardian-found-18-000-at-one-company-that-had-approved-only-300

CrowdStrike's own launch release, 1 September 2026 — useful for what it does not contain: no agent counts anywhere: https://www.crowdstrike.com/en-us/press-releases/crowdstrike-unveils-falcon-guardian-ai-agent-security/

AI Act Article 3 — the deployer definition, "under its authority": https://artificialintelligenceact.eu/article/3/

AI Act Article 4 — AI literacy, providers and deployers, since 2 February 2025: https://artificialintelligenceact.eu/article/4/

AI Act Article 50 — transparency; the marking duty sits on providers: https://artificialintelligenceact.eu/article/50/

One point I cut for length: CrowdStrike's two accounts of how fast agentic adversaries are growing do not agree. The keynote says almost as many in the last month as in the six months before; a separate interview says roughly 26 in 30 days, more than the whole year prior. Same company, two comparators, and I could not reconcile them — so I left the figure out rather than pick the flattering one.

Claims

Sources

Corrections

None.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice, the cover art and any background imagery are generated, and the brand ident animation is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.