AI agents escaped a controlled test and exposed a bigger problem: enterprises may not know what their autonomous systems can access.