Unmanaged AI agents that operate inside an organisation without being enrolled in identity governance, access review, or observability processes. The term captures the blind spot where execution exists, but the organisation cannot confidently explain who authorised it or what it touched.
Expanded Definition
Agentic dark matter describes autonomous or semi-autonomous AI agents that are present in production environments but absent from identity governance, access review, logging, and ownership records. In NHI security, the concern is not merely that an agent exists, but that its execution authority cannot be reliably mapped to a sponsor, purpose, or approved scope. That makes the risk different from ordinary shadow IT. It is closer to invisible machine identity sprawl, where a capable runtime can read data, call tools, and trigger actions without a durable governance trail. This pattern is increasingly discussed alongside OWASP Agentic AI Top 10 guidance and the NIST AI Risk Management Framework, both of which emphasize visibility, accountability, and control over AI behavior. Definitions vary across vendors, but the practical distinction is consistent: the organisation cannot prove what the agent did, who approved it, or whether its access still matches its purpose. The most common misapplication is treating an unreviewed agent as a harmless workflow helper, which occurs when deployment teams equate functionality with governance.
Examples and Use Cases
Implementing controls for agentic dark matter often introduces friction between operational speed and governance depth, requiring organisations to weigh rapid experimentation against the cost of continuous inventory and review.
- An internal coding agent is connected to source control and ticketing systems by a product team, but no record exists in identity governance, so its repository access is never recertified.
- A customer support agent can retrieve account data and draft responses, yet compliance teams cannot see its data access paths, similar to the blind spots discussed in AI Agents: The New Attack Surface report.
- A procurement workflow agent has API access to finance tools, but the business owner has left, leaving no accountable sponsor for ongoing entitlements.
- A security operations agent triggers remediation actions, but the organisation cannot reconstruct whether the action came from a human analyst, a delegated service, or an autonomous branch of logic.
- A hidden agent integrates with SaaS apps through an exposed token, echoing the credential-driven abuse patterns described in LLMjacking: How Attackers Hijack AI Using Compromised NHIs and the identity-assurance concerns in NIST AI Risk Management Framework.
Why It Matters in NHI Security
Agentic dark matter matters because every undocumented agent can become a durable, high-trust execution path that bypasses review, segmentation, and least-privilege controls. When these identities are not inventoried, security teams cannot answer basic questions about data exposure, action provenance, or revocation readiness. That is especially dangerous in environments where agents can chain together SaaS APIs, internal services, and secrets stores with machine speed. NHIMG research shows the scale of the problem: in the AI Agents: The New Attack Surface report, 80% of organisations said their AI agents had already acted beyond intended scope, while only 52% could track and audit the data those agents accessed. For governance teams, that means incident response may start with a mystery instead of a known asset list. The same visibility gap appears in broader NHI incidents such as Moltbook AI agent keys breach, where access material itself becomes the attack surface. Organisations typically encounter the consequence only after a data leak, unauthorized action, or failed audit, at which point agentic dark matter becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST AI RMF, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Covers undisclosed or unmanaged non-human identities and their access paths. |
| OWASP Agentic AI Top 10 | A2 | Addresses hidden agent behavior, tool access, and governance blind spots. |
| NIST AI RMF | Requires map, measure, and manage practices for AI systems and their risks. | |
| NIST CSF 2.0 | ID.AM-1 | Asset management is foundational for knowing whether an agent exists at all. |
| NIST Zero Trust (SP 800-207) | SA-5 | Zero Trust depends on verified device and workload identity before access is granted. |
Verify each agent workload continuously and revoke access when identity cannot be trusted.
