What should my friend do if her work visa agent has had her passport for over three months without approval?

Agent from what city?

Report the passport as stolen asap and get emergency travel document from your embassy. Go back to home country to get real passport and, and restart the whole sequence.

Hope for the best with regards to the identity theft that may result. The employer should be held responsible for any damage here as they required you to hand the passport over to the criminals.

Report the passport stolen and get emergency documents from the embassy and leave Thailand immediately, paying any overstay fee.

You can search the news for this happening many times. Agents are not regulated in Thailand so there's nothing to do about punishing them and even if you write a bad review about their agency you can be arrested and sued.

The police and immigration also won't care and won't make any exceptions. Your friend also cannot work and if they've already been working then they've been breaking the law.