The reviewer that outlived its owner.
An engineer set up an AI code reviewer for their team. It worked, so nobody touched it. It was wired to the repository with the engineer's personal token. When they changed teams, the agent stayed. When the token was supposed to be rotated, it was not, because nobody knew what would break. Six months later it still reviewed every pull request, still called an external model API, and had started talking to a host nobody recognized.
Network Analysis found the agent from its traffic, showed that its credentials belonged to someone no longer on the team, and surfaced two more agents in the same state, left behind by people who had left the company.
The organization assigned owners where the agents were still wanted, removed the rest, and replaced personal tokens with scoped service credentials. The rule that came out of it: every agent has a named owner, and an agent without one is a finding.