The 5-Step Audit for the AI Agents Already Running Your Business

As of July 2026, four separate stories broke on Hacker News in the same 48-hour window, and they all point at the same gap: businesses are running more AI agents than anyone has actually inventoried. LM Studio shipped Bionic, an agent built for open, locally-hosted models, and it pulled 312 points and 114 comments before most readers finished their coffee. Two Y Combinator S26 founders launched Traceforce specifically because they discovered that most companies cannot say which AI apps are running on their own laptops, sandboxes, and virtual machines, let alone how those apps are connected to each other. Capital One, a bank with a regulator on speed dial, open-sourced an agentic code-security tool called VulnHunter. And a small team called Libretto shipped PR agents that can open a pull request against your GitHub repo on their own, with one line of code as the only setup.

None of these are the same product. But they are all reactions to the same condition: agents are already inside the business, doing real work, and nobody built the audit trail first.

Why This Matters

If you run a bank's engineering org, you have a security team to catch this. If you run a landscaping company, a law firm, or a five-location retail chain, you do not, and the exposure is the same shape at a smaller scale. The agents just look different: a voice receptionist booking appointments, a content tool drafting review responses, a browser-automation script filling out supplier forms, maybe a locally-hosted model like LM Studio Bionic running research on an employee's laptop with nobody tracking what it touches. Ratel's founders put a number on the underlying failure mode this week too: they said agents given "unlimited tools and skills" without a routing layer blow up their context window and start making mistakes, not because the tools are bad but because nobody scoped what each agent actually needed. That is an infrastructure problem when Ratel says it. For a business owner, it is the same problem wearing a different coat: agent sprawl outruns agent oversight on every scale.

We have written before about what happens when an agent makes a call nobody signed off on. It is the same failure Traceforce is trying to solve for enterprise IT, just with fewer zeros: an AI agent made a decision nobody approved, and the business only found out after the fact. The fix in both cases is not fewer agents. It is an audit you actually run.

The Agent Audit Playbook

1. Inventory every agent touching the business, by name. Not "we use AI for marketing." List each distinct agent: the voice receptionist, the content drafter, the ad-copy tool, any coding agent with repo access, any browser-automation script, any locally-run model like Bionic that an employee installed without asking. Capital One built VulnHunter because it decided ad hoc agent use in code review was no longer acceptable at their scale. Your list will be shorter, but the exercise is identical: name it, or it does not exist for audit purposes.
2. Map what each agent can DO, not just what it can see. Read access and write access are different risk categories. A content agent that drafts blog posts is low stakes. A browser-automation agent that submits supplier orders, or an agent with push access to your website repo the way Libretto's PR agents do, can take an action with real financial or legal weight in one line of code. Rank each agent by what it can touch: money, customer data, public-facing content, or nothing beyond a draft folder.
3. Put logging in front of capability, not behind it. Before you give an agent a new tool or a new integration, confirm you will actually see what it did with it. Traceforce's whole pitch is that companies discover agent connections only after something goes wrong. Do not wait for that moment. If you cannot answer "what did this agent do last week" in under five minutes, the logging is not there yet, regardless of what the vendor's dashboard claims.
4. Name a human approver for every agent with money, legal, or customer-facing scope. One person, by name, who signs off when that agent's permissions change. This is the single cheapest fix on this list and the one most businesses skip, because it feels like bureaucracy for a five-person shop. It is not. It is the difference between an agent's scope creeping quietly over six months and someone actually noticing.
5. Test the failure path on a schedule, not just the happy path. Ask what happens when the agent gets it wrong: a wrong answer to a customer, a bad supplier order, a code change that breaks the site. Confirm there is a fallback a human can trigger, and that someone knows how to trigger it under pressure, not just in a README.
6. Re-run the audit every time you add a tool or a skill, not once a year. Ratel exists because tool sprawl degrades agent performance quietly, without a single dramatic failure to flag it. Permission sprawl works the same way. The cheapest time to catch scope creep is the day you add the new integration, not the day something breaks because of it.

Common Pitfalls

• Treating "AI" as one bucket instead of a list of distinct agents with distinct scopes, so a low-risk drafting tool and a high-risk repo-access agent get the same level of oversight, which is to say none.
• Leaving every agent without a named human owner, so scope creep has no one to notice it.
• Assuming logging exists because a vendor mentions it in a sales call, instead of confirming you personally can pull a trace of what an agent did last Tuesday.
• Assuming a locally-run agent, like one built on LM Studio Bionic, is automatically safer because it is not calling out to a cloud API. It can still take actions with real consequences on the machine and accounts it has access to.
• Auditing once a year instead of every time a new tool or integration gets added, which is exactly when scope actually changes.

The Audit Checklist

• Every AI agent in use is listed by name, with an owner attached
• Each agent's permissions are documented: read-only, or able to take an action
• You can pull a log of what any agent did in the last seven days, in under five minutes
• A named human approves scope changes for any agent touching money, legal, or customer communication
• A quarterly re-audit date is on the calendar, plus a trigger to re-audit whenever a new tool gets added

None of this requires a security team or a six-figure tooling budget. It requires someone sitting down with the list above for an afternoon. The businesses that skip it are not choosing to avoid the work; they are choosing to find out about it later, the way Traceforce's customers apparently did.

Auditing your own agents is step one. Step two is understanding what the agents your customers already use — ChatGPT, Claude, Perplexity — say about your business when someone nearby asks for the best option in your category. Start with a free AI Visibility Report and see exactly where you stand, in 24 hours.