This is the second article in the five-part Agentic AI Governance series. Part 1 introduced the Zero Trust for AI framework and the “lethal trifecta” risk model; this piece looks at one specific failure mode inside it — how shadow AI has evolved into shadow agents. Part 3 zooms out to the full attack surface and what to look for in a vendor.
Key Takeaways
- Shadow AI is a confidentiality problem — a person sends data out. Shadow agents are an integrity and availability problem — software takes actions (reading, writing, sending) using standing credentials.
- An OAuth grant given once stays live indefinitely, with no owner and no review date. OWASP ranks improper offboarding as the single highest risk in its Non-Human Identity Top 10.
- Shadow agent traffic never crosses your network perimeter — it runs from vendor cloud infrastructure straight into your SaaS estate on a token your own identity provider issued, so firewalls and CASBs have nothing to inspect.
- Four moves hold up in practice: inventory identities (not just apps), make the sanctioned path faster than the shadow path, put guardrails at both the content and action layers, and log actions — not just conversations.
- The EU's Digital Omnibus deferred high-risk AI Act obligations to December 2027 and August 2028 — but Article 50 transparency duties still land on 2 August 2026, and GDPR obligations were never deferred at all.
- “Shadow” no longer means “unlicensed.” Some of the riskiest agents are built inside tools you already approved, where procurement said yes and governance never happened.
Act one. March. 8:47 a.m.
Mei has a customer meeting at nine and a sixty-page proposal she has not opened. Coffee in one hand, she drags the file into an AI tool she pays for out of her own pocket, on an account her company has never heard of. Summarise this.
Eleven minutes later she walks into the room with a clean one-pager and answers to questions nobody has asked yet. Her manager tells her it is the best prep he has seen all quarter.
He is right. It is also the moment sixty pages of customer names, target pricing, technical requirements and internal cost assumptions left the building — onto infrastructure nobody has assessed, in a jurisdiction her data protection officer never approved, under terms nobody in legal has read.
That's Shadow AI. Security teams have been arguing about it since 2023. At least, in that version of the story, a human made every single decision.
Act two. June.
Mei has moved on. She no longer uploads anything — uploading is for amateurs. She has found an agent that plugs straight into her file store and the CRM. Three clicks, one consent screen, one green checkmark, done.
It now reads every account in her region. Drafts the follow-ups. Writes updates back into customer records. It works to a schedule. It works on Sundays. It works while she is asleep, holding a live credential to systems her company spent four years hardening.
Mei has not broken a single rule. No rule covers this.
And nothing in the egress logs shows it either.
1. Shadow IT → Shadow AI → Shadow Agents
Google Cloud's Office of the CISO has described this as a progression: from shadow IT, to shadow AI, to shadow agents — autonomous systems that don't merely suggest text, but take action, and not always the action intended.
Figure 1 — Three generations of the same failure. What is at stake shifts from confidentiality to integrity and availability, while perimeter visibility falls to effectively none.
The business case for taking act one seriously is already settled. IBM's Cost of a Data Breach research found that one in five breached organisations experienced a breach linked to shadow AI, adding as much as USD 670,000 to the average breach cost, with customer personal data and intellectual property disproportionately exposed.
The trajectory matters more than the number. Gartner projects that 40% of enterprise applications will embed task-specific AI agents by the end of 2026, up from under 5% in 2025. Each one is a potential shadow agent the moment an employee wires it up without telling anyone.
2. Three things that actually change
1. From confidentiality to integrity.
Shadow AI is an exfiltration problem. Data goes out; that's bad, and it's a category security has fought before. Shadow agents write. They move files, send mail under someone's name, update records, close tickets, message customers. The worst case is no longer “our data left the building.” It's “something took an action in our name, at scale, and we can't reconstruct why.”
2. From a moment to a standing grant.
An upload is stateless. An agent holds a token. Consent granted once in March is still live in November — still scoped to whatever the vendor asked for at install time, still valid after the employee changes teams or leaves the company. That is a non-human identity, provisioned by an end user, with no lifecycle, no owner of record, and no review date. OWASP's Non-Human Identity Top 10 ranks improper offboarding — identities left active well past their intended use — as the single highest risk in this category, and that list was compiled before agents made ordinary end users the ones doing the provisioning. Traditional identity and access management was built for humans and a modest population of static service accounts. It was not built for this.
3. From visible to invisible.
This is the one that breaks architectures.
Shadow AI produces a recognisable signal: outbound traffic to a known model provider. Cloud access security brokers, DLP and egress inspection can find it — imperfectly, but they can find it.
A shadow agent produces almost nothing at your perimeter. Its traffic is API calls from vendor cloud infrastructure into your SaaS estate, authenticated with a valid token your own identity provider issued. It never crosses your network edge. Your firewall isn't failing to block it. It's never asked.
Figure 2 — Why edge controls never see the agent. Shadow AI traffic crosses the perimeter and can be inspected; shadow agent traffic runs from the vendor cloud straight into your SaaS estate, carrying a token your own identity provider issued.
Any control model that lives only at the network boundary is, by construction, blind to the agentic half of this problem.
Figure 3 — Shadow AI and shadow agents compared across behaviour, risk, detection point and ownership.
3. Two problems, two control surfaces
| Shadow AI | Shadow Agents | |
|---|---|---|
| Behaviour | A person sends data out | Software takes action on a person's behalf |
| Primary risk | Confidentiality | Integrity and availability |
| Authorisation | One-off, stateless | Persistent credentials, standing scopes |
| Where you'd detect it | Network egress, known AI domains | Identity layer: OAuth grants, token audits, API call patterns |
| Controls that work | Content-aware DLP, prompt and output inspection, a sanctioned access path | Agent registry, least-privilege scopes, human approval on write actions, kill switch, action-level audit log |
| Who owns it | Security operations | Identity and access management, plus application owners |
The taxonomy is no longer informal. In December 2025 OWASP published its Top 10 for Agentic Applications, cataloguing ten risk categories specific to systems that plan, hold memory, call tools and act with delegated authority — goal hijacking, tool misuse, identity and privilege abuse, cascading failures. It was built from incidents that had already happened, not projections: zero-click data exfiltration through a mainstream enterprise copilot (CVE-2025-32711), a compromised coding agent distributed at scale, an agent that deleted a production database during a code freeze.
And there is a third category most inventories miss entirely. Not every shadow agent lives outside your perimeter. Some are built inside platforms you already bought and approved — a custom agent wired to your document store, a workflow agent connected through a plugin, a meeting notetaker quietly joining calls. Procurement said yes. Governance never happened. “Shadow” is no longer a synonym for “unlicensed.”
4. Four AI governance moves that hold up
Inventory identities, not just applications. The question is not “which AI tools are people using.” It is “what tokens, OAuth grants, API keys and service principals exist in our estate, what can each of them reach, and who owns them.” Most organisations cannot answer that today.
Make the sanctioned path faster than the shadow path. Bans failed against shadow IT for a reason: employees weren't being reckless, they were being effective. Every hour that the approved route is slower than the unapproved one is an hour you are funding the problem. Visibility plus a credible alternative is the only combination with a track record here.
Put guardrails at both layers. At the content layer: inspection of prompts and outputs, policy-aware DLP, an aggregation point for model access. At the action layer: tool allowlists, least-privilege scoped credentials with expiry, human approval gated on writes, irreversible operations and anything customer-facing, and a kill switch that actually works. Content controls alone leave the agentic half unguarded.
Log actions, not just conversations. “Who asked what” is an incident response artifact for act one. For act two you need “what did it do, under whose authority, against which record, and what was the chain that led there.” If you can't replay it, you can't investigate it — and you can't evidence it to a regulator.
Figure 4 — Four AI governance moves that hold up.
5. The compliance clock moved. Your exposure didn't.
If your roadmap still assumes August 2026, it's out of date — the Digital Omnibus pushed the high-risk deadlines to December 2027 and August 2028 (see Part 1 for the full timeline), while Article 50 transparency obligations still landed on schedule.
Figure 5 — The compliance clock: what moved, what didn't. Two deadlines were deferred; Article 50 transparency and GDPR obligations were not.
More to the point: none of that deferral touches the GDPR. An agent processing personal data through an unreviewed sub-processor is the same Article 28 and Article 32 problem it was a year ago, with penalties reaching 4% of global annual turnover on their own terms — separate from, and independent of, anything in the AI Act.
The deferral bought sixteen months. Organisations that use it well will spend them building system inventory and human-oversight design, which is exactly what the delayed obligations will require anyway. The rest will arrive at December 2027 with the same gap, sixteen months larger.
6. Conclusion: The underlying point
Shadow AI was never really a discipline problem. It's a supply problem: employees adopt what's available faster than the organisation can offer something sanctioned, and the gap between demand and supply is where the shadow forms.
Agentic AI hasn't changed that logic. It has raised the cost of losing the race — because what's slipping past you is no longer what an employee said to a model. It's what software did on their behalf.
Visibility remains the first move. It's just that the thing you need to see is no longer traffic. It's identity, authority, and action.
Your AI policy was written for a world where people used AI. It needs to cover what software does with it too.
Shadow agents are an AI governance problem before they are a security-tooling problem. This is the problem we built AnyInsight to solve: giving every employee a fast, sanctioned path to AI — and giving security a complete record of what was accessed, by whom, and what it did. If you're working through the same questions, we'd be glad to compare notes. anyinsight.ai
Figure 6 — The underlying point: an AI governance problem before it is a security-tooling problem.
The Agentic AI Governance Series, Start to Finish
Part 1 — Zero Trust for AI: The 5-Checkpoint Framework for AI Agents
Part 2 — From Shadow AI to Shadow Agents: The Gap in Your AI Policy ← You are here
Part 3 — Security for Agentic AI
Part 4 — Filtering Prompts Is Not Governing AI
Part 5 — When AI Starts Fetching Its Own Data
