Orca Security has expanded its cloud security tools to help organisations find AI-generated applications and autonomous agents, including ones that security teams may not know are running. The practical shift is from tracking only declared software to looking for signs of what has actually been built and what it can access.
Watch Desk analysis
What happened
Orca says its expanded AI AppGen Security capabilities search cloud infrastructure, DNS records, workloads, code repositories and cloud identities for digital fingerprints left by AI app builders such as Lovable, Replit and Bolt. Teams can link discovered apps to identities, permissions and accessible resources, and review the evidence in a dedicated view and dashboard. The company says the checks do not require extra agents, vendor integrations or employee registration.
The announcement also adds visibility into cloud-managed and self-hosted AI agents, including coding agents running on cloud workloads. Orca says teams can inventory agents, map their connections to models, tools and data stores, and flag risks such as excessive permissions, exposed credentials in MCP configurations, insecure HTTP connections and access to destructive tools. It also offers attribution of AI-generated code to the agents and models that produced it.
Help Net Security reports the announcement and describes the changes as an expansion of Orca’s existing AI security offering.
Why it matters
AI-built apps and agents can appear outside the usual engineering and security processes. A team cannot assess an application’s permissions or an agent’s potential reach if it does not know they exist. Orca’s approach aims to give security teams a way to discover these systems and connect them to the identities, data and infrastructure they can reach.
That is useful operationally, but discovery is not the same as prevention. The announcement describes visibility, risk findings and remediation guidance, not evidence that every hidden app or agent will be found or that identified risks are automatically fixed.
Our read
The interesting part is the focus on the environment’s fingerprints rather than expecting every builder to register their work. That could help security teams catch software made at speed by employees or agents, before it becomes a surprise with access to sensitive data. The test will be whether the findings are accurate and actionable, rather than simply a longer list of things to worry about.
What to watch
- How reliably the discovery tools identify AI-built apps across different cloud setups.
- Whether teams can act on the permission and agent-risk findings without drowning in false alarms.
- How Orca’s code attribution and security integrations work in day-to-day development.
Discussion spark: Should security teams be able to discover and assess AI-built apps across an organisation by default, or should employees have more say over what gets monitored?
Sources and evidence
- Source update (11 November 2026, 09:05 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.