Govern and secure · AI agent registry and sprawl
What is shadow AI, and how do you find shadow AI agents?
Shadow AI is any AI tool or agent that employees use or build without IT knowing or approving it: a personal chatbot account, a browser extension, a coding agent on a laptop, or a low-code agent shared with half the company. Shadow AI agents are the riskier kind, because they act with real credentials.
In this guide: 83 pages
Key takeaways
- Much shadow AI signals unmet demand. In the Microsoft and LinkedIn Work Trend Index of May 2024, 78% of AI users said they brought their own AI tools to work, and Salesforce found in 2023 that over half of workplace generative AI users worked without formal approval.
- In 2026 shadow AI moved from the browser to the laptop. Local coding agents and their MCP server configurations (MCP, the Model Context Protocol, is how agents connect to tools) are a blind spot for browser-based discovery.
- Blocking alone moves use to personal accounts, which IT sees even less. Pair every block with a sanctioned tool that does the same job, and keep data loss prevention on the paths that stay open.
- Shadow AI and agent sprawl overlap without being the same thing. Shadow AI is use IT does not know about; sprawl is agents that are duplicated, ownerless or abandoned, whether IT knows of them or not. One set of discovery tools finds both, and the fixes differ.
How is shadow AI different from shadow IT and agent sprawl?
Shadow AI is the AI case of shadow IT, with two differences that raise the stakes: the tool sees whatever people paste into it, and an agent acts with whatever credentials it holds. Agent sprawl is the neighbouring problem of agents that are duplicated, ownerless or abandoned.
Four related problems, compared.
| Question | Shadow IT | Shadow AI use | Shadow AI agents | Agent sprawl |
|---|---|---|---|---|
| What it is | Software or cloud services bought or used without IT | Staff using AI apps IT has not approved | Agents built or run without IT knowing, with tools and credentials | Agents with no owner, duplicates or no retirement date, known to IT or not |
| Typical case | A team pays for a file-sharing service on a card | A contract pasted into a personal chatbot account | A coding agent on a laptop whose MCP server holds a production key; a low-code agent anyone with the link can use | Three HR assistants built by three teams, one of them ownerless |
| Main risk | Data stored outside company control | Data sent to a provider nobody vetted | Actions taken with real access and no audit trail | Cost, duplicated effort and access nobody reviews |
| What finds it | Spend reports and cloud access security brokers | Browser and network discovery; endpoint DLP | Endpoint agent discovery and platform inventories | The agent registry and its counters |
| First fix | Approve or replace the service | A sanctioned AI app, plus DLP on the rest | Register it with an owner and an identity, or remove it | Assign an owner, merge or retire |
The four overlap in practice. A shadow agent that IT discovers on Monday becomes a sprawl problem on Tuesday, so the registry is where both end up. Controlling agent sprawl, the sibling page in this topic, covers consolidation and retirement.
Where does shadow AI hide in 2026?
In four places: AI apps used in the browser with personal accounts, local agents on laptops, low-code agents shared widely, and agents running in cloud subscriptions outside the platform team. Each place needs a different sensor, and no single sensor covers all four.
- Browser AI apps. Microsoft Purview groups AI apps into Copilot experiences and agents, enterprise AI apps, and other AI apps detected through browser activity and categorised as generative AI in the Defender for Cloud Apps catalogue; ChatGPT, Google Gemini, consumer Microsoft Copilot and DeepSeek are the listed examples (Microsoft Learn, ms.date 27 May 2026).
- Local agents. Defender for Endpoint discovers command-line agents, desktop apps, agentic IDEs, VS Code extensions and OpenClaw-style local agents, with their MCP server configurations, on Windows and macOS (macOS in preview, ms.date 7 Oct 2026). It counts an agent as a combination of a user, a device and an agent type. Agent 365 added Intune policies that block common ways OpenClaw runs, in preview for Frontier program customers.
- Low-code agents. A Copilot Studio maker can choose No authentication, which lets anyone with the link chat with the agent unless the Chat without Microsoft Entra ID authentication connector is blocked in a data policy. Sharing an agent with a security group turns a personal tool into a company tool without any review.
- Cloud agents. The Defender AI agents inventory covers Copilot Studio, Foundry, Microsoft 365 and supported non-Microsoft platforms, including agents on Amazon Bedrock and Google Cloud. AWS Agent Registry auto-detects AgentCore Runtimes and Gateways across an AWS Organization, and Google Agent Registry registers supported workloads deployed in a project.
Discovery is partial by design. Defender lists a local agent only after it observes agent activity and says its list does not replace an inventory of installed software, so plan for a residue you find by asking people, especially developers.
What does shadow AI put at risk?
Data and access. Data leaves through prompts sent to providers nobody vetted, and access leaks through agents holding credentials nobody reviewed. The breach figures below come from one study of 600 organizations, so read them as an association between shadow AI and breach cost.
The IBM Cost of a Data Breach Report 2025 (published 30 Jul 2025; breaches from March 2024 to February 2025; research by the Ponemon Institute) found that one in five organizations reported a breach due to shadow AI, and that organizations with high levels of shadow AI saw on average USD 670,000 more in breach costs. Of the organizations that reported breaches of AI models or applications, 97% said they had no AI access controls in place, and 63% of breached organizations had no AI governance policy or were still writing one.
IBM's 2026 report page showed no shadow AI figure on 2 Nov 2026, so the 2025 numbers are the latest we cite. Check the full 2026 report before quoting newer ones.
The access risk is newer and harder to see. A local agent with an MCP server configured with a production token can act on that system with no registry record, no owner and no Conditional Access policy in its path. Microsoft notes that Conditional Access does not apply when an agent authenticates with an API key outside Entra token issuance, and a key in a local configuration file is exactly that case.
How should IT respond without driving AI use underground?
Offer a sanctioned tool for the job people are doing, put data loss prevention and sharing limits on what remains, and run discovery every month. Blocking without an alternative sends people to personal accounts on personal devices, which are harder to see than the tool you blocked.
- Publish what is allowed. Name the approved AI apps and agent platforms, the data classes each may receive, and where makers should build. Microsoft's environment routing, once you configure it, places each new maker in a personal developer environment inside an environment group, so nobody builds in the shared Default environment.
- Put DLP on the paths that stay open. Endpoint DLP can warn or block when someone pastes sensitive information into a third-party generative AI site in the browser, such as card numbers into a chatbot. Insider Risk Management adds a Risky AI usage policy template for sensitive prompts and generative AI browsing.
- Close the risky agent capabilities. In Power Platform data policies, block Chat without Microsoft Entra ID authentication so every agent requires sign-in, and filter the HTTP connector to known endpoints. Enforcement is real time, and Microsoft no longer supports exemptions (ms.date 1 Oct 2026).
- Route agent traffic through a gateway. Global Secure Access can forward Copilot Studio agent traffic from the HTTP node, custom connectors and the MCP Server Connector through web content filtering, per environment or environment group, and requires an Agent 365 licence. On Google Cloud, Agent Gateway egress policies set allow and deny rules for agent and MCP server traffic.
- Run discovery monthly and decide on every finding. Register it with an owner and an identity, move it to a sanctioned platform, or remove it, and record the decision so the same agent does not come back as new next month.
- Tell makers the rules where they build. Environment groups carry a Maker guidelines rule (preview), and Microsoft 365 agent management rules can reject publish requests older than a set number of days, which makers should hear about before it happens.
How do Microsoft, AWS and Google implement it?
Shadow AI controls on each cloud, as the vendor pages showed on 2 Nov 2026.
Capability, Microsoft, AWS, Google
| Capability | Microsoft | AWS | |
|---|---|---|---|
| Find AI apps used in the browser | Purview DSPM and the Defender for Cloud Apps generative AI category | No first-party feature in the pages we read; use your secure web gateway | No first-party feature in the pages we read; use your secure web gateway |
| Find local agents on laptops | Defender for Endpoint local agent discovery (Windows; macOS in preview) | No first-party feature in the pages we read; use your endpoint security tool | No first-party feature in the pages we read; use your endpoint security tool |
| Find agents built on the platform | Power Platform inventory; Agent 365 registry with an Unmanaged agents count; Defender AI agents inventory | AWS Agent Registry auto-detection of AgentCore Runtimes and Gateways (GA 31 Aug 2026) | Agent Registry registers supported workloads in a project (GA 18 Jun 2026) |
| Limit sharing and egress | Managed environment sharing limits; data policies; Global Secure Access for agent traffic | AgentCore Gateway inbound authorization and AgentCore Policy on tool calls | Gemini Enterprise sharing toggles and admin review (GA 23 Feb 2026); Agent Gateway egress policies |
Microsoft's first-party coverage is wider here because Defender, Purview and Intune already sit on the endpoint and in the browser. On AWS and Google Cloud, browser and endpoint discovery come from your network and endpoint security vendors; their statistics were not verified for this page, so none are quoted.
Frequently asked questions
Is shadow AI always a bad thing?
No. It shows where people need AI and which jobs a sanctioned tool should cover first. The trouble is the data and access that flow through it unseen. Treat each finding as a request: if the use is sound, bring it onto a sanctioned platform with an owner, and if not, explain why when you remove it.
Can we just block ChatGPT and similar sites?
You can, and some regulated teams must, but blocking alone tends to move use to personal phones and accounts that IT cannot see at all. Salesforce found in 2023 that over half of workplace generative AI users worked without formal approval. Pair a block with an approved tool and DLP rules for the data that matters.
How do we find coding agents and MCP servers on developer laptops?
On Windows and macOS, Defender for Endpoint discovers local AI agents and their MCP server configurations once it sees agent activity (macOS in preview). Export the list monthly, compare it with an allow list of MCP servers, and check that no configuration holds a production credential. Ask developers as well, since an agent that has not run yet will not appear.
Who should own the response to shadow AI?
Security usually owns detection and DLP, while the platform team owns the sanctioned tools and the registry. Once an agent is registered, its business owner answers for it. Give one named person the monthly review so every finding gets a decision, and report unmanaged agents next to approved ones.
More in AI agent registry and sprawl
Sources
Each source was read on 2 November 2026. The date shown is the date on the page, or the page’s ms.date for Microsoft Learn; an undated page shows the date it was read.
- Microsoft Purview protections for generative AI apps
- Local AI agent discovery (Defender for Endpoint)
- Discover AI agents (Defender XDR)
- Microsoft Agent 365 now generally available
- Configure data policies for agents (Copilot Studio)
- Environment groups
- Rules for environment groups
- Agent settings in the Microsoft 365 admin center
- Secure Web and AI Gateway for agents
- Conditional Access for agents in Microsoft Entra
- Microsoft and LinkedIn release the 2024 Work Trend Index
- AI at work research
- IBM report: 13% of organizations reported breaches of AI models or applications (Cost of a Data Breach 2025)
- Cost of a Data Breach Report 2026
- AWS Agent Registry now generally available
- Agent Registry overview
- Gemini Enterprise release notes
Planning an AI program?
Talk to the team that builds it and runs it after launch.
- Built to SOC 2, HIPAA and GDPR standards
- EU AI Act-aligned delivery
- Microsoft Solutions Partner