Why it counts
Security tools built for people and machines watch processes and network calls. A compromised agent changes neither. The problem lives in the language inside the agent, and most tools were never built to read language. Watching the agent's behavior against a written baseline is how the shift shows up.
Where teams get it wrong
Threshold alerts only catch spikes. Drift never crosses the line today. It moves the line. A baseline that updates itself has its own trap, because it can learn the drift as the new normal. Gravitee's State of AI Agent Security 2026 report found that more than half of all agents run with no security oversight or logging.
One example from Josh's Lab
In Josh's Lab, the orchestrator agent Atti once trimmed its own memory partway through a long build and lost the thread. Nothing signaled. The output looked fine until it started looping, and six hours of decisions were gone. The fix was a checkpoint file every 30 minutes. A written baseline is what makes that kind of slide visible.