First of all, please disregard everything anthony.green wrote. It is all wrong. He may be referring to groups set up for SQL Server 2005, it isn't clear. In any case, SQL Server and SQL Agent both run under NT Service accounts unless you change them (say because you need to access network items within the SQL Server or SLQ Agent umbrella) during install or afterwards in service properties.

For some reason, by default, SQL Server 2012 installs so that the NT Service\SQLAgent$<Instance> account does not have access to the BINN folder. The only means that I have found to fix the issue is to hack through the default permissions down to the binn folder (see the executable path in the properties for the service) and grant read/execute permissions to the NT Service ID (you may have to change file ownership in this folder to make this happen). This install program seems to set them for the corresponding MSSQL$<Instance> ID.