How to discover shadow AI agents in your company
Employees are spinning up ungoverned AI agents faster than security can track. Here is how to inventory every shadow agent, across browser, network, endpoint, and SaaS, before one causes a breach.
To discover shadow AI agents, you inventory across four surfaces, browser, network, endpoint, and SaaS, because that is where ungoverned agents actually run, and no single tool sees all four. Shadow AI agents are the automations and AI assistants that employees and teams spin up without security’s knowledge or approval, and they are not a rare edge case: a Cloud Security Alliance survey found that 82% of enterprises have unknown AI agents running in their environments (CSA1). That is not a fringe risk; it is the default state. And it is already causing damage: 88% of organizations reported confirmed or suspected AI agent security incidents in the past year (Gravitee2). I build agent identity and governance tooling at RankShield, and the first question every security team asks is the hard one: how do we even find them all? What most coverage leaves out is a concrete, surface-by-surface discovery method, most of it stops at describing the problem. This guide is the runbook: what shadow AI is, how big the problem really is, exactly where these agents hide, how to inventory them across your environment, and how to govern what you find. One honest note: you will not find every agent in one pass, and new ones appear constantly, which is why discovery has to become a continuous process, not a one-time audit.
What is shadow AI, and why does it matter?
Shadow AI is any AI agent, assistant, or automation running in your organization without security’s knowledge, approval, or governance, the AI equivalent of the shadow IT problem, but faster and harder to see. An employee connects an AI assistant to company data, a team wires up an agent to automate a workflow, a developer spins up an MCP server to give an agent tools, and none of it goes through review. Each is doing real work, which is exactly why it spreads: shadow AI looks like productivity, not risk.
It matters because these agents have access and act autonomously, so an ungoverned one is an unmonitored actor inside your systems. Unlike a human employee who gets a badge, an offboarding process, and access reviews, a shadow agent often runs on a shared API key with broad standing access and no owner. When it misbehaves, whether through a bug, a prompt injection, or a compromise, there is frequently no record you can trust of what it did, because logs may be editable or were never written.
The scale is what turns this from a governance nuisance into a security priority. With 82% of enterprises harboring unknown AI agents and 88% already reporting incidents, shadow AI is not a hypothetical you are getting ahead of; it is a present condition you are behind on. Discovery is the first step to closing that gap, and it starts with knowing what you are actually looking for and where it lives.
How big is the shadow AI agent problem?
It is nearly universal and already causing incidents. A Cloud Security Alliance survey found 82% of enterprises have unknown AI agents in their environments, and 65% had experienced an AI agent-related incident in the past 12 months, with 61% reporting data exposure, 43% operational disruption, and 35% financial losses (CSA1). Separately, Gravitee found 88% of organizations reported confirmed or suspected AI agent security incidents in the past year (Gravitee2). These are not projections; they are what is already happening.
The reason the numbers are this high is that agents proliferate through normal work, not through malice. Every team that adopts an AI assistant, every developer who connects an agent to a tool, every SaaS app that ships a built-in AI feature adds to the population, usually without a security review. The infrastructure underneath compounds it: OX Security found roughly 200,000 exposed MCP instances, with 38% lacking authentication (Infosecurity Magazine3), meaning many of the agents you have not inventoried are also running on servers with no access control.
The practical implication is that you should assume you have shadow agents, plural, right now, and that some of them have access they should not. That assumption reframes discovery from an optional audit into an urgent inventory. If you want every agent to carry a verifiable identity so it cannot run in the shadows in the first place, that is what RankShield’s agent identity layer is built to provide.
Where do shadow AI agents hide?
Shadow AI agents hide across four surfaces, and you have to look at all four because each hides a different kind of agent. The browser holds AI extensions, assistants, and copilots that employees install and connect to company data. The network carries the API calls and outbound connections agents make to model providers and tools, which is often where an otherwise invisible agent becomes detectable. The endpoint runs local scripts, desktop agents, and developer tools that call AI. And your SaaS stack contains both built-in AI features and third-party agents connected through integrations and OAuth grants.
The map below shows where to look and what you are looking for on each surface. The reason a single tool misses shadow AI is that these surfaces are monitored by different systems, browser security, network monitoring, endpoint detection, and SaaS governance, and an agent visible to one is often invisible to the others. An agent running as a browser extension may never appear in your network logs; an agent making direct API calls may never touch an endpoint you monitor.
The highest-yield surface for most organizations is the network, because nearly every agent eventually talks to a model provider or a tool over the network, so outbound connections to AI endpoints are a reliable signal even for agents you did not know existed. But the network alone misses local-only and browser-embedded agents, which is why the complete inventory requires all four. The next section turns this map into a discovery sequence you can actually run.
How do you discover shadow AI agents across your environment?
Run discovery as a sequence across the four surfaces, starting with the network because it catches the most agents for the least effort. First, review outbound network connections for traffic to known AI model providers and tool endpoints; an agent you never approved will still make these calls, so this single step surfaces a large share of shadow agents. Second, inventory browser extensions and their permissions across your fleet, looking for AI assistants and copilots with access to company data. Third, scan endpoints for AI tooling, local agent frameworks, and scripts that call model APIs. Fourth, audit your SaaS OAuth grants and app integrations for connected AI agents and built-in AI features.
Correlate what each surface finds, because the same agent may appear differently on each, or on only one. An agent found making network calls should be traced back to the endpoint or browser that runs it and the identity it uses; an OAuth grant to an AI app should be matched to who approved it and what it can reach. The goal of correlation is a single inventory: each agent, where it runs, what it can access, who owns it, and whether anyone approved it. That inventory is the deliverable, not a pile of alerts from four separate tools.
Make it continuous, because a one-time audit is stale the day after you run it. Employees create new agents constantly, so schedule the network review and the OAuth audit to run regularly, and treat any new outbound AI connection or new AI OAuth grant as something to investigate. The organizations that stay ahead of shadow AI are the ones that turned discovery into a standing process, not a quarterly project, which is the only cadence that keeps pace with how fast agents appear.
What does an ungoverned agent cost you?
An ungoverned agent costs you the ability to prevent, detect, or explain what it does, which is why the incidents tied to shadow AI are so damaging. When an agent runs with broad standing access and no monitoring, a single compromise or mistake has a large blast radius, and you often cannot reconstruct what happened. The CSA data makes the cost concrete: among organizations with agent-related incidents, 61% saw data exposure, 43% operational disruption, and 35% financial losses (CSA1).
The specific danger of a shadow agent versus a known one is the absence of a record. A governed agent that misbehaves leaves a tamper-evident trail you can investigate; a shadow agent may leave editable logs or none at all, so your incident response starts with "we are not sure what it could reach" rather than "here is what it did." That uncertainty extends the incident, complicates disclosure, and makes it hard to prove the scope of exposure to regulators or customers, which is often more expensive than the technical breach itself.
This is why discovery is only valuable if it leads to governance. Finding an agent tells you the risk exists; it does not reduce it. The cost of an ungoverned agent stays on your books until you give it an identity, scope its access, and put a trustworthy record around what it does, which turns an unmonitored actor into an accountable one. The final section covers how to make that transition for the agents your discovery surfaces.
How do you govern agents after you find them?
Govern a discovered agent by giving it a verifiable identity, scoping its access to least privilege, assigning it an owner, and putting a tamper-evident record around what it does. Discovery produces an inventory; governance is what turns each entry from a liability into a controlled asset. The first move for any agent you find is to answer four questions: who owns it, what does it need to access, what does it currently access, and can you prove what it did. The gap between what it needs and what it has is the access you revoke.
Identity is the foundation, because you cannot govern what you cannot name. An agent with a distinct, verifiable identity can be granted least-privilege, just-in-time access, monitored, and revoked, the same lifecycle you apply to human employees. An agent running on a shared API key with no owner can do none of that, which is why so many shadow agents are also over-permissioned: no one scoped access to an identity that did not really exist. Establishing per-agent identity is what makes every other control possible.
Then bound and record. Replace standing broad access with scoped, expiring credentials, require approval for high-impact actions, and seal a tamper-evident record of what each agent does so misbehavior is caught and provable. That is precisely the lifecycle RankShield’s agent passports are built to enforce: a verifiable identity, bounded access, and a receipt for every action, so an agent you discovered today becomes an accountable one tomorrow instead of the next incident.
How do you stay ahead of shadow AI?
Shadow AI is the default state, not the exception: most enterprises already have unknown agents running, and most have already had an incident. You cannot govern what you cannot see, so start with discovery across all four surfaces, browser, network, endpoint, and SaaS, leading with outbound network connections because they catch the most agents for the least effort. Correlate the findings into a single inventory of each agent, where it runs, what it can reach, and who owns it. Then make discovery continuous, because employees create new agents faster than any one-time audit can track.
Finding agents is only half the job; governing them is what reduces the risk. Give each discovered agent a verifiable identity, scope its access to least privilege, assign an owner, and put a tamper-evident record around what it does, so an unmonitored actor becomes an accountable one. That transition is what turns your discovery work into actual risk reduction. If you want every agent to carry a verifiable identity, bounded access, and a receipt for every action, see how RankShield governs AI agents from discovery through control.
Questions, answered.
What is shadow AI?
Shadow AI is any AI agent, assistant, or automation running in your organization without security’s knowledge, approval, or governance. It is the AI version of shadow IT, but faster and harder to see: an employee connects an AI assistant to company data, a team wires up an agent to automate a workflow, or a developer spins up a server to give an agent tools, none of it through review. It spreads because it looks like productivity rather than risk. It matters because these agents have access and act autonomously, so an ungoverned one is an unmonitored actor inside your systems, often running on a shared key with broad access and no owner. A Cloud Security Alliance survey found 82% of enterprises already have unknown AI agents in their environments.
How much does shadow AI cost a company?
The cost is measured in incidents and lost visibility rather than a single dollar figure. Among organizations with AI agent-related incidents, a Cloud Security Alliance survey found 61% experienced data exposure, 43% operational disruption, and 35% financial losses, and 88% of organizations reported confirmed or suspected AI agent security incidents in the past year per Gravitee. The specific cost of a shadow agent versus a governed one is the absence of a record: when an ungoverned agent misbehaves, you often cannot reconstruct what it reached, so incident response starts from uncertainty. That uncertainty extends the incident, complicates disclosure to regulators and customers, and makes the scope of exposure hard to prove, which is frequently more expensive than the technical breach itself.
How do you detect shadow AI agents?
Detect them by inventorying across four surfaces, starting with the network because it catches the most agents for the least effort. Review outbound network connections for traffic to AI model providers and tool endpoints, since an unapproved agent still makes those calls. Inventory browser extensions and their permissions for AI assistants with access to company data. Scan endpoints for local agent frameworks and scripts that call model APIs. Audit SaaS OAuth grants and integrations for connected AI agents and built-in AI features. Then correlate the findings into a single inventory of each agent, where it runs, what it can access, and who owns it. Because a single tool misses agents visible only on other surfaces, all four are required, and discovery must be continuous rather than a one-time audit.
Where do unsanctioned AI agents hide?
They hide across four surfaces, each concealing a different kind of agent. The browser holds AI extensions, assistants, and copilots that employees install and connect to company data, often invisible to network logs. The network carries the API calls agents make to model providers and tools, which is the highest-yield surface because nearly every agent eventually talks to the network. The endpoint runs local scripts, desktop agents, and developer tools that call AI from a laptop or server you may not centrally monitor. And your SaaS stack contains built-in AI features and third-party agents connected through integrations and OAuth grants you may have forgotten approving. An agent visible to one surface is frequently invisible to the others, which is why a complete inventory requires checking all four.
What do I do after I find a shadow AI agent?
Govern it. Discovery tells you the risk exists; it does not reduce it. For each agent you find, answer four questions: who owns it, what does it need to access, what does it currently access, and can you prove what it did. The gap between what it needs and what it has is the access you revoke. Then give it a verifiable identity, because you cannot apply least-privilege access, monitoring, or revocation to an agent running on a shared key with no owner. Replace standing broad access with scoped, expiring credentials, require approval for high-impact actions, and put a tamper-evident record around what it does so misbehavior is caught and provable. That lifecycle turns an unmonitored shadow agent into an accountable, governed one.
Can I ever fully eliminate shadow AI?
No, and treating elimination as the goal sets you up to fail. Employees will keep adopting AI assistants and building agents because they are useful, so new shadow agents will always appear, which is why discovery has to be continuous rather than a one-time cleanup. The realistic and effective goal is not zero shadow agents but zero ungoverned ones: find agents quickly, and bring each into governance with a verifiable identity, scoped access, and a trustworthy record before it can cause harm. An organization that discovers agents continuously and governs what it finds is in a strong position even though new agents keep appearing, because the window between an agent being created and being governed stays short. That is a durable posture; a one-time purge is not.
References
- Cloud Security Alliance. Survey: 82% of enterprises have unknown AI agents in their environments; 65% had an agent-related incident (61% data exposure, 43% disruption, 35% financial loss).
- Gravitee. State of AI Agent Security: 88% of organizations reported confirmed or suspected AI agent security incidents in the past year.
- Infosecurity Magazine (OX Security disclosure). ~200,000 exposed MCP instances; 38% of scanned servers had no authentication.
Jamie Kloncz
Founder & CEO, RankShield
Jamie Kloncz is the founder and CEO of RankShield, the verifiable AI and quantum security platform. He started the company after two attacks landed in a single week: his phone was cloned, and his business was hit by a click-fraud campaign. One targeted him as a person, the other his livelihood, and no single tool defended both. That experience, together with surviving an AI voice-clone scam, shaped RankShield’s core belief: the threats of the AI age are personal first, and trust should be something you can check, not just extend.
Make every AI action provable.
RankShield is the verifiable, quantum-safe AI security platform — protection you can check, not just trust.