Shadow AI agents are sneaking into your company, and nobody has the keys

A new report highlights the quiet and dangerous proliferation of 'shadow AI agents' within enterprises. These are autonomous AI tools, often built by non-security employees using frontier models in minutes, that are granted access to critical systems like email, ERP software, and Slack without the knowledge of the security team. A survey found that while 68% of IT professionals believe they have good visibility, 82% discovered unknown agents in their environment over the past year.

The article follows a hypothetical agent built by an accounts payable clerk to process invoices. It identifies five critical security gaps in its lifecycle: how it obtains broad OAuth grants and static API keys, operates without logging or monitoring, and persists with overprivileged access. The real-world impact is a surge in unmanaged, high-privilege access points that attackers can exploit. The sharp takeaway is that the ease of agent creation has outpaced security governance, creating a massive, invisible attack surface that traditional security tools are blind to.