Shadow AI Is Becoming Shadow Agents: Why the Next Risk Is Action, Not Data
Shadow AI is moving from employees using unapproved chat tools to employees building unapproved agents that act on company systems. The risk changes with it. A chatbot can leak data, while an agent can update records, send messages and spend money under credentials nobody reviewed. Governance has to follow actions, not only data.
For most of the last two years, shadow AI meant one thing in enterprise security reviews: an employee pasting company data into a chatbot the company had not approved. That problem has not gone away, but it is no longer the one that concerns me most.
The next wave is already here. Employees are not only using AI tools on their own, they are building agents that read systems, make decisions and take actions on the company's behalf. When that happens without review, the risk moves from what the AI knows to what the AI does.
From Shadow AI Tools to Shadow AI Agents
A shadow AI agent is an agent built or deployed by an employee or team without approval from IT, security or the owner of the systems it touches. Unlike a chatbot, it does not wait for a prompt. It acts on a schedule or a trigger.
The tools made this shift easy. Low code and no code builders now sit inside the productivity suites people open every morning, so building an agent takes an afternoon and a plain language description.
The scale is already measurable. According to Microsoft's Cyber Pulse report, based on Microsoft telemetry and a survey of more than 1,700 data security professionals, over 80% of Fortune 500 companies use active agents built with low code or no code tools, and 29% of employees have used unsanctioned agents for work tasks. Agent building has spread into business roles faster than review processes have.
Consider a sales operations analyst who is tired of stalled quotes slipping through the cracks. She builds an agent that reads the CRM each morning, drafts a discount offer for any quote older than 14 days and emails the customer directly. It works, the sales team relies on it, and nobody in IT or finance knows it exists.
Nothing about that analyst is reckless. She solved a real problem with the tools she was given, which is exactly why this pattern will keep growing.
Why Shadow AI Risk Moves From Data to Action
Shadow AI risk moves from data to action when the unapproved tool can write to company systems, not just read from them. Data leakage is a confidentiality problem, while unapproved action is an operational, financial and legal problem.
The Agent Carries Real Credentials
An employee built agent usually connects to systems through its builder's own login or a token created in a hurry. It can do anything its builder can do, at machine speed and without the judgment the builder applies in the moment.
In the quote example, the agent can offer discounts nobody in finance approved. Each email it sends is a commitment made in the company's name.
The Agent Keeps Running After Attention Moves On
A shadow agent continues to operate long after the person who built it stops watching it. Chat sessions end, but agents keep running.
When the pricing policy changes, the agent keeps applying the old rule. When the analyst changes teams, the agent keeps working with access that no review is checking.
The Agent Is Invisible to Old Discovery Methods
Traditional shadow AI discovery looks for traffic to known AI websites, and that method misses most agents. An agent running inside an approved productivity suite looks like ordinary approved usage.
This is why many security teams find shadow agents only after something goes wrong. The trigger is usually a customer complaint, an unexpected discount or an audit question nobody can answer.
What Shadow AI Will Look Like by 2028
Shadow AI by 2028 will be less about individual tools and more about large populations of agents that nobody has fully mapped. The forecasts all point the same way.
Gartner has forecast that the average global Fortune 500 company could have more than 150,000 agents in use by 2028, as reported by No Jitter. Even if only a small share of those are unsanctioned, no team will be able to track them by hand, so discovery and ownership will have to become continuous.
Three shifts follow from that scale:
- Agents will call other agents. An unapproved agent will hand tasks to approved agents, which makes it harder to separate a shadow agent from the governed estate.
- Business units will build faster than central teams can review. Review queues measured in weeks will lose to builders working in hours.
- Auditors will ask about agents by name. Not knowing an agent existed will stop being an acceptable answer for any agent that touched customers, money or personal data.
Why Banning Agent Building Will Not Work
Banning agent building fails because it removes the approved path while leaving the workaround in place. People build shadow agents because the sanctioned route is slower or missing, not because they want to bypass security.
Every earlier wave of shadow technology followed the same pattern. Shadow IT shrank when companies offered approved cloud tools that were quicker to get than unapproved ones, not when they sent warning emails.
The same logic applies to agents. The goal is an approved route to building agents that is faster than the unapproved one, with governance built in from the start rather than added later.
The Shadow AI Questions Enterprise Leaders Should Be Asking Now
The shadow AI questions worth asking now are about agent actions and ownership, not only about which websites employees visit. The table sets the old questions beside the new ones.
| Area | Shadow AI question (tools) | Shadow agent question (actions) |
|---|---|---|
| Discovery | Which AI sites employees are using | Which agents are running, and on which systems |
| Access | What data went into a chatbot | What each agent can read and write, and under whose credentials |
| Accountability | Who used the tool | Who owns the agent today, and who approved its actions |
| Change | Whether the tool was blocked | Whether the agent changes when policy changes |
| Exit | Whether the account was closed | What happens to the agent when its builder leaves |
Most of these questions map onto controls enterprises already understand. A sound AI governance framework covers the policy side, and AI agent lifecycle management covers how an agent is registered, reviewed and retired once it is found.
How AIQoD Approaches Shadow AI Agents
AIQoD treats every agent as a registered identity with its own scoped access, rather than a script running on someone's login. That design addresses the action risk directly.
On our platform, each agent authenticates with its own credentials, and both read and write access are granted per agent and per system. Each agent carries a Dynamic Twin that records its decisions and permissions, and actions above a set threshold go to a human in the loop approver before they execute.
Conclusion
Shadow AI is not shrinking, it is changing shape. The next generation of unapproved AI will not sit in a browser tab, it will run on schedules, hold credentials and act on customers, money and records.
Enterprises that keep measuring shadow AI by website traffic will miss most of it. The leaders who handle it well will treat agents the way they already treat people: known identities, defined access, a named owner and human approval for decisions that matter.
Frequently Asked Questions
These answers cover the questions enterprise teams raise most often about shadow AI agents.
What is the difference between shadow AI and shadow AI agents?
Shadow AI is any AI tool used for work without approval, most often a chatbot or an AI feature inside an app. Shadow AI agents are the subset that take actions on company systems, which makes their risk operational rather than only informational.
Why are shadow AI agents harder to detect than shadow AI tools?
Many agents run inside approved productivity suites and use their builder's legitimate credentials, so their activity looks like normal usage. Discovery has to inspect agents and their permissions directly instead of watching for traffic to AI websites.
Should enterprises stop employees from building their own agents?
Blocking agent building usually pushes the activity further out of sight, because the business need does not disappear. A faster approved path with identity, access controls and approval gates built in reduces shadow agents more effectively than a ban.
Who should own a shadow agent once it is found?
Every discovered agent needs a named business owner accountable for what it does, along with a technical owner for its access. If nobody accepts ownership, the agent should be paused until someone does.
