Same villain, bigger teeth: The shadow AI problem

Shadow IT is not new. We've had it since the first employee inserted a floppy to access a piece of data, and the second someone installed an application to get something done. IT admins managed this age-old problem with a formula that was only partially working—never 100%. Shadow IT still lurks in organizations. Today, it has mutated into shadow AI and, like all mutations, it has evolved to become even more notorious.

Every on-device agent is an extension of an application. Eventually, every application will evolve into an agentic application. This is not a matter of if, but when. Future agentic applications will be operating with far more autonomy than the traditional applications used today. Their behavior will no longer stay predictable. The risk, now amplified, remains a data loss problem in one form or the other.

The first is the one that is most apparent and you may already be worried about: Proprietary knowledge involves customer records and source code being fed into systems we don't own and can't audit.

The second is that LLMs and AI tools become a gateway that allows malware in via prompt injections. This can result in monetary or data loss, or even both.

Third, the agent does something no one intended. This is neither a leak nor an attacker, but an autonomous and destructive action, executed at machine speed. One wrong instruction, carried out faithfully and instantly, could wipe out your whole device. It could even wipe out your bank account, if you have your card information linked.

That third risk is what you should be most worried about because it's the least understood. We have decades of practice defending against data loss and intruders, but we have almost none defending against our own tools that are acting on bad judgment.

Against shadow IT, your framework loosely looks like this: you gain visibility of all the assets, applications, and resources you've got, and you deploy policies to block or approve resources based on how strict your policies can be. The same framework works, as agents are just extensions of your applications.

Visibility extends beyond your Software Asset Management (SAM) framework to knowing all the agents you have. It doesn't stop there. You need to know what tools each of your agents have access to, what user-level privilege it is running under, what MCP tools it can connect to, what APIs it can call, the websites it can reach, and more. If an agent running under a high-privilege account also has MCP access to finance systems, payroll, or CRM, the exposure is extreme. User identity and agent identity become intertwined in ways that are hard to manage. Today, this visibility is not easy to gain.

Once you have visibility into all these aspects, you need to control them. This is again a challenge because even with the visibility, agentic applications are unpredictable. You never know their outbound behavior, especially what the agent calls, contacts, or executes outside the device. Control is not as simple as an approve or block list.

While visibility and control systems need to evolve, there's a third aspect that needs to be added to the framework: threat hunting. You will need your system to hunt for anomalous agent behavior and monitor for privileged identity misuse.

While this framework can give you a head start, AI agents need more scrutiny. Much like endpoints, agents will need to get onboarded before they're trusted. They need to be discovered, inventoried, and given an approval status. Unlike a managed endpoint, a managed agent cannot be trusted by default. Because agents behave differently over time, they'll need to be associated with a real-time risk score that acts like a track record—trusted more as they earn it and watched more closely the moment they start acting outside their usual pattern.

The software we are comfortable governing today is turning into something we aren't yet familiar with. The good news is that the current shadow IT playbook can still hold with some additions that address the volatile nature of agents: agents that improvise, act under borrowed identity, and occasionally do what no one asked. It's the same villain with bigger teeth, so it is better to start monitoring before we get to the part where we wish we had.