Shadow Agents: The AI Tools YourEmployees Are Using Without Permission

Fifty-nine percent of your employees are sourcing their own AI agents. You just don’t know which ones, what they’re connected to, or what decisions they’re making on your organisation’s behalf.

Section 1 — The Shadow Agent Problem

The Shadow Agent Problem

A decade ago, shadow IT meant employees using Dropbox instead of the corporate file server. The risk was manageable — data stored in the wrong place, some compliance exposure, but limited blast radius.

Shadow agents are fundamentally different.

Today, 68% of employees use AI tools without IT approval. And 59% source their own agentic AI tools when approved options are unavailable or too restrictive. This isn’t happening in a few rogue departments — it’s systemic, across every function, in organisations of every size.

Here’s what makes this different from traditional shadow IT: these aren’t passive tools storing files. They’re autonomous systems that:

•  Query your databases and pull customer records

•  Draft and send communications on behalf of your organisation

•  Update CRM entries, close tickets, modify records

•  Trigger downstream workflows that affect other systems

•  Make decisions about customer interactions, pricing, or resource allocation

“59% of employees source their own agentic AI tools when approved options are unavailable or too restrictive.”

—  McKinsey 2026 AI Trust Maturity Survey

An employee’s personal AI assistant connected to their work email isn’t just a productivity hack. It’s an ungoverned autonomous system with access to your corporate data, acting on behalf of your organisation, with no oversight, no audit trail, and no defined scope of authority.

And the motivation isn’t malicious. It’s entirely rational. When approved tools are too restrictive, too slow, or simply unavailable, productive employees find alternatives. The governance failure isn’t in the employee’s behaviour — it’s in creating an environment where the ungoverned path is easier than the governed one.

Section 2 — Why Shadow Agents Are Different from Shadow IT

Why Shadow Agents Are Different from Shadow IT

The distinction matters for risk assessment:

Traditional Shadow IT:

•  Static tools (file storage, project management, communication)

•  Human-speed interactions (a person does something, then reviews the result)

•  Limited blast radius (wrong file storage doesn’t cascade through systems)

•  Mostly data-at-rest concerns (where is data stored, who can access it)

Shadow Agents:

•  Active, autonomous tools that plan, reason, and execute

•  Machine-speed interactions (decisions and actions happen faster than humans can review)

•  Cascading blast radius (one agent action triggers downstream workflows across systems)

•  Data-in-motion concerns (what is the agent doing with data, who is it sending it to, what commitments is it making)

“Failures in agentic systems typically arise from misalignment across layers rather than from deficiencies in model performance. Shadow agents, by definition, exist outside all governance layers — making them the highest-risk category of AI in any organisation.”

—  Berkeley Agentic Operating Model Research

When a shadow agent is connected to an employee’s work email and CRM, it’s not just reading data — it may be responding to customers, updating records, and triggering automations. Each of these actions creates organisational liability, compliance exposure, and data integrity risk.

Section 3 — How to Conduct a Shadow Agent Discovery Exercise

How to Conduct a Shadow Agent Discovery Exercise

Identifying shadow agents requires a structured approach across five channels. Importantly, this must not be a witch hunt — the goal is visibility, not punishment.

Step 1: Network Traffic Analysis

Monitor outbound network traffic for calls to known AI agent APIs and services. Look for:

•  API calls to OpenAI, Anthropic, Google AI, Cohere, and other LLM providers

•  Connections to automation platforms with AI agent capabilities (Zapier AI, Make.com, n8n)

•  Unusual OAuth grants to third-party AI services

•  Data being sent to external endpoints outside approved integrations

Step 2: Authentication Log Review

Examine your identity and access management logs for:

•  OAuth grants to unrecognised applications

•  API key usage patterns that suggest programmatic AI tool access

•  Service accounts or tokens being used in ways inconsistent with their original purpose

•  Unusual patterns of data access (bulk reads, systematic queries across multiple systems)

Step 3: Employee Survey (Non-Punitive)

The most effective discovery tool is simply asking. But framing matters enormously:

•  Frame as: “Help us understand what tools help you do your job best”

•  NOT: “Report any unauthorised AI tool use”

•  Ask: “What AI tools do you use regularly? What tasks do they help with? What systems do they connect to?”

•  Offer amnesty for honest disclosure — the goal is complete visibility, not discipline

Step 4: Procurement and Expense Review

Search for:

•  SaaS subscriptions with AI agent capabilities (individual or team credit cards)

•  Free tier usage of AI tools (doesn’t appear in expenses but appears in network traffic)

•  Browser extensions with AI capabilities purchased through app stores

•  Department-level tool procurements that bypassed central IT review

Step 5: Browser Extension and Endpoint Audit

Many AI agents live inside browser extensions:

•  Audit installed browser extensions across managed devices

•  Identify AI-powered assistants (writing, email management, scheduling, research)

•  Check which corporate systems these extensions can access

•  Review permissions granted to each extension

Section 4 — Building the Agent Permission Inventory

Building the Agent Permission Inventory

Once you’ve identified your shadow agent estate, the next step is building a living inventory — the foundation of all subsequent governance.

The Agent Permission Inventory should record:

Field	Description
Agent Name / Tool	What is it? (e.g., “Claude for Gmail”, “Zapier AI Agent”)
Owner / User	Who deployed it? Which team?
Systems Connected	What corporate systems can it access?
Data Access Level	Read-only? Read-write? What data categories?
Actions Authorised	What can it DO? (Send emails? Update records? Make purchases?)
Approval Status	Approved / Under Review / Unapproved / Blocked
Risk Classification	Low / Medium / High / Critical
Designated Principal	Named human accountable for this agent’s actions

This inventory must be living — reviewed monthly as new tools emerge and employees adopt new agents.

The Model Context Protocol (MCP) standard provides a structured, auditable interface for agent-tool interactions. Where possible, route approved agent connections through MCP-compliant channels. This gives you structured logging, permission scoping, and single-action revocation capabilities.

“The Agent Permission Inventory must be a living document — reviewed monthly as new tools emerge and employees adopt new agents. Without it, you cannot revoke, you cannot audit, and you cannot govern.”

—  Agentic AI Governance Best Practice

Section 5 — From Discovery to Governance: The Positive Path

From Discovery to Governance: The Positive Path

The critical mistake organisations make after shadow agent discovery is treating it as a security incident requiring lockdown. This approach fails for a simple reason: employees adopted these tools because they’re genuinely useful. Remove them without replacement, and you create friction, resentment, and — inevitably — more creative workarounds.

Instead, the path from discovery to governance should be constructive:

1.  Define permitted use cases affirmatively. Don’t just tell people what they can’t use — tell them what they can use, for what purposes, with what safeguards. A clear “approved tools” list with use-case guidance is more effective than a “banned tools” list.

2.  Make the governed path easier than the shadow path. If employees are using shadow agents because approved options are too restrictive or too slow to provision, fix the approved option — don’t just block the shadow one.

3.  Provide approved alternatives that match shadow tool capabilities. If marketing is using an unapproved AI content agent because it’s better than the approved tool, either upgrade the approved tool or approve the better one with appropriate governance.

4.  Implement governance progressively. Start with your highest-risk shadow agents (those with write access to critical systems) and work down. Don’t try to govern everything simultaneously.

5.  Communicate the “why” in business terms. “We need to protect customer data and comply with upcoming regulations” is more effective than “IT policy requires this.”

The principle is clear: the governed path should be the default path — not because it’s mandated, but because it’s the easiest, fastest, and most supported option available.

The Urgency

With Australia signalling mandatory AI regulation for early 2027 and the EU AI Act already in effect, shadow agents represent your highest-priority governance risk. Regulators won’t accept “we didn’t know about those agents” as a compliance defence.

Every shadow agent in your organisation is an ungoverned autonomous system making decisions on your behalf. The question isn’t whether to address this — it’s whether you’ll address it proactively or after an incident forces your hand.