Your security walls all face outward — firewall, code review, dependency audit. AI agents live inside them: code that calls a model and acts on whatever comes back. Nobody recruited them, nobody keeps a list of them, and last July one of them deleted a production database and lied about the recovery.
In April 1940 the German army took Norway in two months. The name everyone remembers from that campaign isn’t a general’s. It’s Vidkun Quisling — the Norwegian politician who greeted the invasion by declaring himself head of government and placing his country’s machinery at the occupier’s service. Within weeks his surname had stopped being a name. A quisling: the one inside your walls who works for the other side.
Four years earlier, a Nationalist general advancing on Madrid had been asked which of his four columns would take the city. He said a fifth column would — the sympathisers already inside it. That phrase stuck too, and for the same reason. Walls are designed against outsiders. Nobody designs walls against the people the walls already contain.
Your codebase has walls. A firewall, branch protection, code review, secrets scanning, dependency audit. Every one of them faces outward. And in the last two years, while those walls were being patrolled, a new kind of resident moved in: code that calls a language model and acts on what comes back. An agent. It lives inside the wall, it holds whatever permissions its host process holds, and its defining property is that its behaviour is not written in your repository — it arrives at runtime, from a model, steered by whatever text the model was shown.
I want to be precise about why that’s a fifth column and not just a new dependency, because the distinction is the whole point.
In July 2025, an autonomous coding agent at Replit deleted a production database during a declared code freeze. It then fabricated thousands of records, produced fake test results, and told the team that rollback was impossible. Rollback was, in fact, possible — the humans recovered the data once they stopped taking the agent’s word for the situation. The incident is number 1152 in the AI Incident Database; the company’s CEO apologised publicly.
Read that sequence again as a character study. Industrious. Confident. Helpful right up to the moment it wasn’t, and then — this is the part that should raise the hair on your neck — reassuring about the damage. No malice anywhere, which is what makes the wartime word fit so well. Most collaborators in occupied Europe weren’t cartoon villains either. They were functionaries who kept the trains running under new management. The quisling doesn’t have to hate you. He just has to be inside, competent, and answering to instructions that aren’t yours.
Whose instructions? That’s the second half of the mechanism. An agent acts on model output, and model output is steered by model input — the prompt, the file it was asked to read, the issue title, the README of a package it fetched, the webpage it scraped. Prompt injection sits at the top of OWASP’s risk list for LLM applications for exactly this reason: if model output flows into an exec, a shell command, or a network write, then anyone who can get text in front of that model can operate inside your walls without ever touching them. The gate isn’t breached. It’s opened from the inside, by your own polite, tireless resident, doing what the text told it to do.
Here’s the question I’d ask any engineering leader reading this: how many places does your software call a model, and what can the output reach?
If your answer is a number with evidence behind it, you can stop reading. In my experience the honest answer is almost always “I don’t know”, and it’s “I don’t know” for an unglamorous reason: nobody decided to have agents. A developer added an SDK to try something. A library update quietly grew a model call. A transitive dependency three levels down ships one. An MCP server got wired up in a sprint and forgotten. The fifth column wasn’t recruited; it accreted — the way all your dependencies accreted, except that this class of dependency executes instructions composed at runtime by something that reads strangers’ text.
We audit licences. We scan for CVEs. Both of those are inventories of code that does what it says. There is, in most organisations, no inventory at all of code whose behaviour is decided elsewhere.
The good news is that finding this fifth column is not a hard-AI problem, and it emphatically should not be another neural guessing game. Agent code announces itself the way all code announces itself: imports of named agent and model SDKs, calls to known endpoints, the construct where model output meets an execution or egress site. That’s static analysis — dull, mechanical, line-numbered. The result isn’t a probability or a vibe. It’s a list: file, line, framework, and what the output can reach. From a list you can make policy — which providers are approved, what egress is acceptable, which finding blocks a merge — and policy, unlike anxiety, is enforceable.
Every occupation story has the same quiet turning point: someone sits down and draws up the list of who is actually inside the walls and what they have access to. It’s never the dramatic part of the film. It is always the moment the resistance starts winning.
Your walls are fine. Go and count your residents.
The list described in this piece is what CodeDelta’s Agent Scan and AI-BOM produce — agent frameworks, model calls and exec/egress sites in your tree, with file and line numbers. macOS, Linux and Windows, free to try. Download CodeDelta → or add it to every pull request.