Connect
If you think agentic shadow AI isn’t running in your environment right now, look closer.
It’s not hiding behind a suspicious login or an unusual network spike. It looks like a Slack workflow that auto-responds to support tickets. Or it looks like an API key a developer pasted into a no-code builder last quarter. It could be a browser extension that one of your sales reps installed to summarize call notes, and that now has full read access to your CRM.
Across industries and company sizes, 72% of organizations already have AI agents running in production. Not in testing. Not in evaluation. Live, doing real work, right now. Yet only 23% have the AI maturity and IT unification needed to govern those agents safely.
The gap between deployment and governance is where risk lives. And the first step to closing it is knowing what you’re looking for.
Here are the four most common forms of shadow agentic AI and the signals that tell you each one is already operating in your organization.
Workflow Agents Leave Actions With No Actor
The most common form is an agent built to run a multi-step job end-to-end. Someone wires one up to triage IT tickets, reconcile invoices, or provision new hires, then lets it operate without a checkpoint.
From your side, the agent doesn’t look like software. It looks like a very productive employee. The signal is its rhythm. Tickets are closing in seconds rather than minutes. Records are being updated at 3 a.m. on a Sunday. One agent is producing a volume of actions and no human is able to explain that workload.
The reason the agent stays invisible is that most teams are only reviewing it after the fact. Post-action logging is now the most common oversight model, used by 44% of organizations. Logs will show you everything that the agent did. They won’t tell you an agent did it.
Connector and Developer Agents Act Through Credentials You Already Issued
The second and third forms share a tell. Both run on a credential a human handed over to them.
Unvetted connectors wire third-party AI directly into Slack, Salesforce, or a cloud console using API keys and OAuth tokens nobody governs. Developer agents go further. They run commands, manage repositories, and change infrastructure, because shipping faster is worth the trade to the person who granted the access.
You need to check three places. Your OAuth grant list in each major app, filtered for anything approved by an individual user rather than an admin. Your API key inventory, specifically keys with no rotation date and no named owner. And your repository activity, for commits arriving on a schedule instead of on a workday.
What you’re looking for is a credential that outlived its reason for existing. Agents don’t resign. When the project wraps or the employee leaves, the agent keeps authenticating with the entitlements it was given, and it is still running while being unwatched. These agents are orphaned non-human identities with no owner and no off switch, and they are the easiest thing on this list to find once you know to look.
Browser and Endpoint Agents Ride a Session You Already Trust
The fourth form is the hardest to see, because it generates almost no distinct signal at all.
Browser and endpoint agents read page elements, click buttons, run scripts, and move through internal dashboards inside the user’s own authenticated session. To every logging system you own, the traffic is the employee. Same identity, same device, and with the same permissions.
That leaves you two places to look, and neither is your access logs. The first is your browser extension inventory: unfamiliar extension IDs, and permission scopes broad enough to read and change data on every site the user visits. The second is endpoint telemetry showing a browser process driving input events rather than a person.
Permission breadth is the thing to weigh here. An over-permissioned extension can reach the CRM, the admin console, and every internal app open in that window, all granted in a single click.
What to Do the First Time You Find One
Resist killing it. An agent someone built to survive a broken process will be rebuilt somewhere you can’t see, and you’ll have traded a governance problem for a visibility problem.
Ask three questions instead. What does this agent touch? Who owns it by name? And when does its access expire? Most shadow agents fail the second and third questions immediately, and that is the actual gap. Assign a human owner, scope the entitlements down to what the task requires, and set the permissions to expire on their own. The agent keeps working. You get an inventory entry, an accountable name, and an end date.
Discovery is the part you can start this week without a budget line or a new tool. Governing what you find is the longer project, and we cover the full lifecycle in The New State of Agentic Shadow AI.
The New State of Agentic Shadow AI
Meet the newest form of shadow IT: learn why it’s risky and how to stop it.
