API keys and credentials. Agents operate inside authorized permissions where firewalls can't see. Traditional security models weren't built for this. Your developers are already experimenting.
Government blocks Wingo app for facilitating large-scale SMS fraud, using users' phones in cyber crime activities without their knowledge.