A CRM record changes at 2:14 a.m. and nobody was logged in. The audit log points to a service account created eleven months ago by an analyst who left in March, driven by an automation in a workflow tool nobody in IT has ever opened. It has write access to opportunity records, it calls an external model API to draft the text it writes back, and it has run twice a night since February. It is not malware. It is an agent an employee built to save herself an hour a week, doing exactly what she told it to do.
That scene is ordinary now, and the gap between adoption and control is measurable. The Gravitee "State of AI Agent Security 2026" report found 81% of teams are past the planning phase while only 14.4% have full security approval, and 88% of organizations confirmed or suspected an AI-related security incident this year. The 2026 CISO AI Risk Report, a structured survey of 235 CISOs, CIOs, and senior security leaders at large enterprises of 5,000 or more employees across the United States and United Kingdom, sharpens it: 92% lack full visibility into their AI identities, 86% do not enforce access policies for those identities, and 71% say AI systems can reach core business platforms while only 16% govern that access effectively. The OWASP GenAI Security Project published version 2.01 of its "State of Agentic AI Security and Governance" guidance on August 3, 2026.
The supply side will make it worse. Gartner predicts 40% of enterprise applications will ship task-specific AI agents by the end of 2026, up from under 5% in 2025, so your agent count grows whether or not an employee builds anything. If you have EU operations or customers, the EU AI Act's August 2026 obligations for high-risk systems are in force, with penalties for provider and deployer breaches reaching 15 million euros or 3% of global turnover.
A shadow AI agent is any autonomous or semi-autonomous software process that uses an AI model to take action in your environment without IT approval, inventory, or security review. It differs from a chatbot because it does things: it reads data, calls APIs, writes records, sends messages, or triggers workflows, usually under a human's credentials or a long-lived service token. To bring shadow agents under control, do four things in order. First, discover them by auditing identity provider OAuth grants, SaaS admin consoles and vendor AI feature flags, API key and token inventories, network egress to model API endpoints, expense and corporate card data, and code repositories and CI pipelines. Second, record each one in an agent registry with a named human owner, the credentials and data it touches, its trigger, and its blast radius. Third, tier each agent by the sensitivity of the data it reads and the reversibility of the actions it can take. Fourth, sanction the valuable ones under managed credentials, contain the risky ones, and retire the abandoned ones. Do not issue a blanket ban: it removes the incentive to disclose without removing the agents, and you lose the visibility you were trying to gain.
Nearly every agent we find traces back to one of five sources, and the sources tell you where to look.
Shadow SaaS was tractable because it left a paper trail: a login, a subscription, an invoice. Agents break that model in three ways.
They act instead of storing. A shadow SaaS app held data you did not want it to hold, which is bad but static. An agent sends email, updates records, moves items through approvals, and files tickets. The risk is unauthorized action at machine speed with nobody in the loop.
They hide behind human identity. Most run on a person's OAuth token or API key, so your logs show that person acting, not the agent. Identity is the load-bearing control, which is why we treat AI agent identity and access management as the first real fix rather than a later refinement.
They are non-deterministic. A script does the same thing every run. An agent decides, and it can respond to a poisoned document or a crafted email by taking an action nobody anticipated. Prompt injection stops being theoretical the moment an agent has write access and reads untrusted input, which is where AI security diverges from traditional application security.
Run these in parallel. Most organizations get a usable first inventory in two to three weeks, and none of it requires new tooling.
Technical discovery misses agents on personal accounts and laptops. Send a short, blameless survey to department leads asking what automations their teams rely on, and promise plainly that nothing gets shut off without a conversation. Frame it as continuity: if the builder leaves, does the team know how it works? That question gets honest answers.
The registry is the deliverable, and a spreadsheet is fine to start. The fields matter more than the tooling.
The registry is also the front door for deliberate work. Teams standing up custom AI agents or new workflow automation should register before deployment, and the same fields feed your AI agent observability and monitoring baseline.
Score on two axes only: data sensitivity and action reversibility. Complicated rubrics do not get used.
Two modifiers push a tier upward regardless of score: the agent processes untrusted external input (inbound email, web content, uploaded files), or it can invoke other agents. If your operations touch EU data subjects, map Tier 1 agents against the AI Act's high-risk categories now rather than during a compliance sprint later.
Sort every finding into one of three buckets within a week. Speed beats precision, because an unsorted inventory decays.
Sanction the agents doing real work. Move them off personal credentials onto managed non-human identities with least-privilege scopes, add logging, assign owners, register them. This is usually the largest bucket and the one that buys goodwill: the builder keeps the thing, supported, with someone else carrying the operational risk.
Contain the agents that are useful but overpermissioned or opaque. Narrow the scopes, insert approval on irreversible actions, cap what they reach, and set a remediation date with the owner.
Retire abandoned pilots and duplicates. Revoke credentials, disable the schedule, archive the configuration. Announce retirements before they happen, because every silent shutoff costs you three future disclosures.
The instinct after a bad finding is to prohibit all unapproved AI use. The failure mode is predictable. A ban does not delete the agents that already exist, it just makes people stop telling you about them. The automation moves to a personal laptop, a personal account, and a personal card, which is strictly worse than the same automation on a corporate identity you can audit and revoke.
It also stops working the moment vendors ship agentic features by default. If 40% of enterprise applications include task-specific agents by year end, a ban on "AI tools" is functionally a ban on your own CRM, and policy that cannot be enforced teaches people to ignore policy generally. None of this argues for allowing everything: narrow, specific prohibitions work precisely because they are enforceable, so draw hard lines at no agent touching regulated data from a personal account, no agent holding unattended money-movement or entitlement-change authority, and no company data into consumer-tier accounts with no data processing agreement.
The alternative is a fast, credible path to yes: a one-page standard, a ten-minute registration form, and a review service level measured in days. When the sanctioned path beats the workaround, disclosure becomes the default. Pair it with a short AI agent governance checklist so approvers apply the same test every time, and amnesty the first wave. Anything disclosed in the first 60 days gets help, not discipline.
Days 1 to 30: see it. Name an accountable owner. Run the OAuth export, the egress query, and the expense pull. Interview the top five departments. Publish the amnesty window and the one-page standard. Deliverable: a first-pass registry, however incomplete, plus a tested kill switch for anything flagged Tier 1.
Days 31 to 60: sort it. Finish the admin console walkthrough and the repository scan. Tier every registered agent, execute the retire bucket, and move the top ten Tier 1 and Tier 2 agents onto managed identities with scoped credentials. Deliverable: a sorted registry with owners assigned and the highest-risk items contained or sanctioned.
Days 61 to 90: hold it. Wire registration into the paths where agents are born: pull request templates, admin change approvals, procurement intake. Add agent identities to your joiner-mover-leaver process, because departure-orphaned agents are the most reliable finding in every environment we have assessed. Stand up alerting on Tier 1 agents and set the recurring feature-flag review. Deliverable: a registry that stays current without a project behind it.
Do the OAuth grant export this week. It takes an afternoon, requires no budget, and surfaces findings that make the rest of the program easy to fund. Sort by scope, look for grants belonging to people who no longer work there, and bring three concrete examples to your next leadership meeting. Specifics move faster than frameworks.
If you want outside help, the useful engagement is narrow: a discovery sweep across the six discovery surfaces above, a populated registry with tiers and owners, and a 90-day remediation plan your team can run. That is what our assessment covers, and it is the front half of any serious AI consulting engagement we take on. We work from Dallas-Fort Worth and deliver this remotely nationwide, since discovery is a log-and-console exercise.
One last thing worth saying plainly. The agents you find will mostly be good ideas built by capable people solving real problems with the tools they had. Treat the inventory as a map of where your business wants automation, not a list of violations. Organizations that handle this well end up with fewer agents, better ones, and a workforce that tells them what it is building.
Infonaligy helps IT and security leaders discover, inventory, and govern AI agents from our Dallas–Fort Worth base and remotely nationwide.
An Infonaligy shadow-agent discovery engagement pulls your OAuth grants, SaaS admin consoles, API key stores, egress logs, expense data, and code repos into a single ranked agent inventory. You get a populated registry, a risk tier for every agent found, and a 30/60/90 remediation plan your team can execute. We deliver it remotely from Dallas-Fort Worth, typically inside three weeks.
Infonaligy