Same villain, bigger teeth: The shadow AI problem

Shadow IT is not new. We've had it since the first employee inserted a floppy to access a piece of data, and the second someone installed an application to get something done. IT admins managed this age-old problem with a formula that was only partially working—never 100%. Shadow IT still lurks in organizations. Today, it has mutated into shadow AI and, like all mutations, it has evolved to become even more notorious.

Every on-device agent is an extension of an application. Eventually, every application will evolve into an agentic application. This is not a matter of if, but when. Future agentic applications will be operating with far more autonomy than the traditional applications used today. Their behavior will no longer stay predictable. The risk, now amplified, remains a data loss problem in one form or the other.

The first is the one that is most apparent and you may already be worried about: Proprietary knowledge involves customer records and source code being fed into systems we don't own and can't audit.

The second is that LLMs and AI tools become a gateway that allows malware in via prompt injections. This can result in monetary or data loss, or even both.

Third, the agent does something no one intended. This is neither a leak nor an attacker, but an autonomous and destructive action, executed at machine speed. One wrong instruction, carried out faithfully and instantly, could wipe out your whole device. It could even wipe out your bank account, if you have your card information linked.

That third risk is what you should be most worried about because it's the least understood. We have decades of practice defending against data loss and intruders, but we have almost none defending against our own tools that are acting on bad judgment.

Against shadow IT, your framework loosely looks like this: you gain visibility of all the assets, applications, and resources you've got, and you deploy policies to block or approve resources based on how strict your policies can be. The same framework works, as agents are just extensions of your applications.

The first step is to Observe. Visibility extends far beyond your traditional Software Asset Management (SAM) framework. Organizations need to know every AI agent operating in their environment, what tools each agent can access, the user privilege it runs under, which MCP servers it can connect to, the APIs it can invoke, the websites it can reach, and much more. If an agent is running under a high-privilege account while also having access to finance systems, payroll, or CRM platforms through MCP, the potential blast radius is significant. User identity and agent identity become intertwined in ways that are difficult to manage. Gaining this level of observability is itself a challenge today.

Once agents are observable, the next step is provisioning. Organizations need to define what each agent is allowed to access, which tools it can use, the identities it can assume, and the guardrails within which it can operate. This is more complex than managing traditional applications because agentic systems are inherently dynamic. Their outbound behavior cannot always be predicted, particularly when they interact with external services, invoke APIs, or execute actions beyond the endpoint. Provisioning therefore becomes more than maintaining allow and block lists. It requires policy-driven controls that continuously govern what an agent is permitted to do.

While visibility and control systems need to evolve, there's a third aspect that needs to be added to the framework: run-time defense. Even well-provisioned agents require continuous oversight after deployment. Organizations need systems that can monitor agent behavior in real time, detect anomalous activity, identify misuse of privileged identities, and investigate actions that deviate from expected behavior. As agents become increasingly autonomous, runtime defense becomes the safety layer that catches what static policies cannot.

Existing endpoint management and security platforms will need to evolve across all three stages, providing the observability, provisioning controls, and runtime defenses required to manage AI agents, as they become more common.

While this framework can give you a head start, AI agents need more scrutiny. Much like endpoints, agents will need to get onboarded before they're trusted. They need to be discovered, inventoried, and given an approval status. Unlike a managed endpoint, a managed agent cannot be trusted by default. Because agents behave differently over time, they'll need to be associated with a real-time risk score that acts like a track record—trusted more as they earn it and watched more closely the moment they start acting outside their usual pattern.

The software we are comfortable governing today is turning into something we aren't yet familiar with. The good news is that the current shadow IT playbook can still hold with some additions that address the volatile nature of agents: agents that improvise, act under borrowed identity, and occasionally do what no one asked. It's the same villain with bigger teeth, so it is better to start monitoring before we get to the part where we wish we had.