# Your Company Has AI Agents Running Right Now That Nobody Approved
The SOC doesn't know about them. IT doesn't know about them. The CISO definitely doesn't know about them. But your sales team's new Copilot workflow, the marketing intern's Zapier AI nodes, and the three "automations" someone spun up in HubSpot last month? They're running. They have OAuth tokens. They're sending emails and updating records and sometimes talking to external APIs — right now, while you read this.
Shadow IT was a headache. Shadow AI agents are a different category of problem.
## The Permission Sprawl Nobody Mapped
For fifteen years, security teams fought the shadow SaaS battle — employees signing up for Dropbox, Slack, Notion without IT sign-off. The risk was containment: data sitting in unauthorized places. Annoying. Auditable. Mostly recoverable.
AI agents change the threat model entirely. An agent doesn't just *store* — it *acts*. It reads your CRM and writes to your Slack and fires off calendar invites and, in some configurations, executes code. The OAuth grants it accumulates along the way are persistent, often over-scoped, and tied to individual employee accounts that may leave the company without anyone revoking the agent's access.
The Nudge Security research on this problem makes the attack surface concrete: agents typically authenticate through OAuth2 flows that grant them access far beyond what the specific task requires. A scheduling assistant that needs to read one calendar ends up with write access to the entire workspace. Nobody negotiated that scope — the user clicked through the permission dialog in thirty seconds.
## How They Spread Without Anyone Noticing
The proliferation pattern is predictable once you see it. A business user discovers an AI tool that automates some tedious workflow. They connect it to their work account. It works. They tell a colleague. The colleague installs it too. Within six months, a dozen employees have granted API access to the same third-party agent — each under their own credentials, each grant silently accumulating in the OAuth authorization table of whatever SaaS platform they used.
Enterprise platforms make this worse. Microsoft 365 Copilot, Salesforce Einstein, and Google Workspace's Gemini integrations all support agent-like extensions that individual users can enable without admin approval, depending on tenant configuration. The line between "plugin" and "autonomous agent" has blurred to the point of meaninglessness in most enterprise software catalogs.
And then there's the DIY tier. n8n, Make, and Zapier all support multi-step AI-driven workflows that functionally operate as agents — they poll for triggers, make decisions, and take actions. They're not marketed as AI agents. They don't show up in AI governance audits. They absolutely have credentials to your production systems.
## What Discovery Actually Looks Like
Finding these agents requires a different approach than traditional shadow IT discovery. Browser-based tools that intercept OAuth authorization requests can surface new agent registrations in real time. API gateway logs — if you're capturing them — will show authentication patterns from non-human principals. Most enterprise platforms now expose an "Apps & Integrations" admin view that lists OAuth grants; most organizations have never audited it.
Nudge Security's approach centers on analyzing OAuth token issuance at scale, correlating the requesting application with known AI services, and flagging autonomous vs. interactive usage patterns. The distinction matters: an employee logging into ChatGPT for manual queries is a different risk from an agent that authenticates hourly to pull data.
The assessment criteria that matter most aren't complicated:
Most organizations can't answer any of these questions for agents they didn't formally procure.
## The Insider Threat Problem Nobody's Saying Out Loud
Here's the angle that's getting underplayed in coverage of shadow AI: these agents create a persistent insider threat vector that survives employee turnover.
When an employee with a grudge sets up an AI agent with broad OAuth permissions and then leaves the company, that agent keeps running unless someone explicitly revokes it. The OAuth token doesn't expire when the employee offboards — in most implementations it persists until someone notices or the token hits an expiry limit, which can be a year or more. The former employee no longer needs access to your systems. Their agent does.
This isn't theoretical. The mechanics are identical to the supply chain attacks we've seen hit CI/CD pipelines — long-lived credentials attached to automated processes that persist through personnel changes.
## Governance Before the Incident
The Nudge Security framework for AI agent governance follows a reasonable sequence: discover, assess, then govern. The governance piece is where most organizations will struggle, because it requires organizational decisions that security teams can't make unilaterally.
A blanket "no unauthorized AI agents" policy will fail immediately — the business value is real and users will route around restrictions. The more durable approach is a tiered approval framework: self-service permitted for read-only agents with no external data transmission, expedited review for agents with write access, and full security review for anything that touches financial data, customer PII, or production infrastructure.
The technical control layer looks like OAuth governance tooling, periodic credential rotation enforcement, and scoped service accounts that limit what any agent can access at the permission level. Most SaaS platforms now support application-level OAuth restrictions that let admins whitelist which third-party apps can request tokens — this is underused.
---
## HackWire Analysis
The shadow AI agent problem is shadow IT with autonomous action capabilities and, critically, a much shorter window before something actually breaks.
When shadow SaaS peaked as a corporate risk around 2015-2018, the consensus security response took three to five years to solidify: CASB tools, OAuth auditing, SSO mandates. The industry was reacting to data residency and compliance risks — serious, but slow-moving. Shadow AI agents compress that timeline because agents don't wait. They act on schedules, on triggers, on data state changes. The risk isn't "data might be in the wrong place someday." It's "an agent with write access to your CRM is running a workflow someone set up six months ago and nobody remembers why."
The comparison to supply chain compromise is apt in a way that hasn't fully landed in enterprise risk conversations. When SolarWinds happened, the entry point was a trusted software update mechanism — something the organization explicitly allowed. Shadow AI agents are the same pattern inverted: the organization explicitly allowed an employee to use OAuth, and that employee created a persistent autonomous actor that the organization has effectively no visibility into.
What's missing from the current conversation is accountability for platform vendors. Microsoft, Salesforce, and Google have built agent-capable platforms and pushed them aggressively into enterprise without building commensurate governance tooling. Admin consoles for agent oversight are still nascent. Audit logging for agent actions is incomplete. The vendors created the proliferation problem; security teams are being handed the remediation bill.
For defenders: start with the OAuth grants. Pull the full list from every major SaaS platform in your stack today. Flag anything that authenticated non-interactively in the last 90 days and hasn't been reviewed. That list is your shadow agent inventory. It will be longer than you expect.
— HackWire Editorial
---
## Related Coverage