Quick Answer: A shadow AI agent is an agent that acts in your systems with a real credential but appears in no inventory and has no approved owner. You find them in six places: MCP config files, OAuth grants, egress logs, agent features in your SaaS, ownerless keys and expense reports. Then you give each one an owner or switch it off.
Most companies are sure they know every AI agent they run, and most have never checked. That gap is where shadow AI agents live: agents that hold real credentials and do real work, but that nobody approved, registered or owns.
The numbers are stark. In a Harness survey of 700 technology professionals at large enterprises, fielded in July 2026 and published that September, 77% were confident they had a complete inventory of every agent, MCP server and LLM in their environment. Only 44% ran any discovery tooling to check. And 41% of the whole sample said they had no shadow AI while running nothing that could tell them otherwise (Harness, State of Agent DLC 2026).
This explainer covers what shadow agents are, why they're harder to spot than a shadow chatbot, where to look, and what to do with each one you find. We build cowork.ink, where every AI coworker works under its own name, so "which agent did that?" is a question we deal with every day.
What is a shadow AI agent?
A shadow AI agent is an AI agent that acts in your systems with a real credential but sits outside any inventory, review or ownership. It usually isn't malicious. Someone built it to save an hour a week, and it worked.
What separates it from ordinary shadow AI is that it doesn't wait for a person. A shadow chatbot leaks what an employee pastes into it. A shadow agent holds an API key or an OAuth token, runs on a schedule or a trigger, and reads, writes and sends on its own, with whatever access the person who built it had.
| Shadow IT | Shadow AI | Shadow AI agent | |
|---|---|---|---|
| What it is | An unapproved app | An unapproved AI tool a person uses | An unapproved agent that acts on its own |
| Who acts | A person | A person, with AI help | The agent |
| Main risk | Data stored in the wrong place | Data pasted into the wrong place | Actions taken with the wrong access |
| When it runs | When someone opens it | When someone prompts it | On a schedule or trigger, often overnight |
| How you find it | Domain or OAuth grant | Traffic to AI domains | Credentials, configs and behavior together |
Why do shadow AI agents appear?
Because building an agent now takes an afternoon, and approving one still takes weeks. A sales analyst can wire up a nightly CRM digest in Zapier or n8n. A developer can connect Cursor or Claude Code to GitHub and Slack through MCP servers in minutes. Copilot Studio and Agentforce put agent builders inside tools the company already pays for.
Approval isn't keeping up. In IBM's Cost of a Data Breach Report 2026, 68% of breached organizations had no governance to manage AI or detect shadow AI. Among those that did have policies, the share requiring IT approval for AI deployments fell to 38%, from 45% a year earlier.
The bill arrives in the same report. The share of breaches involving shadow AI more than doubled in a year, from 20% to 43%, and those breaches cost an average of $5.39 million. IBM's definition covers any unapproved AI use, not only agents. Agents are the part of it that keeps acting after the builder has gone home, or left the company.
Where do shadow AI agents hide?
In six places, and you can check most of them with consoles and logs you already have. Discovery products exist (our AI agent identity guide lists several launched in September 2026), but a manual sweep finds the first wave and tells you whether you need one.
| Where to look | What to look for | What a hit means |
|---|---|---|
| MCP config files on laptops | ~/.cursor/mcp.json, ~/.claude.json, Claude Desktop's claude_desktop_config.json, project .mcp.json and .vscode/mcp.json; collect them with an MDM script | Which tools an agent on that machine can call, and often the tokens it calls them with |
| OAuth grants and personal access tokens | Admin consoles of Google Workspace, Microsoft Entra, Slack, GitHub, Notion: unfamiliar apps, broad mail or file scopes, tokens named "mcp" or "cursor" | A token used in the last seven days means something is still running on it |
| Egress and DNS logs | Calls to api.openai.com, api.anthropic.com, generativelanguage.googleapis.com, openrouter.ai, grouped by source machine | A server calling a model at 03:00 every night is a schedule, not a person |
| Agent features in SaaS you already pay for | Agent, automation and scheduled-run pages in Copilot Studio, Agentforce, Zapier, n8n, Make | Agents built inside an approved tool, which network monitoring never sees |
| Keys and service accounts | Model-provider org consoles, vaults, repos and cloud IAM: long-lived keys nobody can name an owner for | A credential that has outlived the person or project that created it |
| Expense reports and corporate cards | AI subscriptions and API top-ups that never went through review | Someone is paying for an agent; find out what it does |
The hardest case: an agent using someone's login
An agent that drives a browser with a person's own login leaves no OAuth grant and no API key, so you find it by behavior. In every log it looks like that person. The tells:
- Activity while the person is offline, on leave or asleep
- Perfectly regular timing, such as an export at 06:00 every day to the minute
- Sessions from cloud-provider IP ranges or headless browsers
- Volume no human produces, like hundreds of records opened in a few minutes
Then ask
The cheapest discovery tool is a message to the team: "We're listing the agents and automations we rely on so we can keep them running." Frame it as an inventory, not an investigation. People who built a useful agent usually want it to survive the audit.
What do you do with a shadow agent once you find it?
Give it an owner first, then decide whether it stays. The person who built it is usually the right owner. Punishing them only teaches the next person to hide better. Then sort each agent into one of four outcomes:
- Adopt. It does useful work with sensible access. Register it, name an owner and move it onto its own credential.
- Restrict. Useful, but over-permissioned. Cut its access to what the job needs; our guide to AI agent permissions shows how.
- Rebuild. Useful, but running on a person's login or a shared key. Rebuild it on a sanctioned platform under its own identity.
- Retire. Nobody claims it, or nobody can say what it's for. Revoke the credential and watch for a week to see what breaks.
Every agent you keep needs the same minimum: a name, an owner, its own credential and a tested off switch.
Revoking an unknown token can break a workflow someone depends on. Find the owner and confirm what the agent does before you revoke, unless it is actively leaking data.
How do you stop new shadow agents from appearing?
Make the approved path faster than the shadow one, and make discovery continuous. Blocking AI tools outright pushes the same work onto personal accounts and devices, where you can't see it at all.
- No credential without a registry entry. If agents can only get keys through a request that records an owner, your AI agent inventory stays current on its own.
- Repeat the sweep monthly. Once scripted, the six checks above take an afternoon. A list checked once a year is out of date by the next week.
- Treat shadow agents as demand. If the CRM digest was worth building in secret, it's worth providing openly.
- Add agents to offboarding. Before someone's account closes, list every token and agent tied to them.
Our AI agent governance framework turns these into a written policy, and MCP security best practices covers the servers behind the config files you'll find.
Give Your Team Agents Everyone Can See
People build shadow agents because the work is real and the approved route is slow. At cowork.ink, the approved route takes about three minutes: create an AI coworker, say what it's for, hand it the context, connect Slack or Telegram and give it the first task.
Each coworker comes with the three things a shadow agent lacks. It shows up under its own name, so you always know which coworker did what. It has a person on your team who set it up and gives it work. And every run leaves a transcript of the steps it took and the pages it opened. Because each coworker has its own computer, give it its own logins in the tools its role needs, the way you'd onboard a new hire; we make that case in coworker AI.
One flat price covers every coworker you set up: $25/month billed yearly, or $29 monthly, with a 15-day money-back guarantee.