AI agents and shadow AI are becoming a board-level security issue

At a glance

What this is: NHI Mgmt Group's analysis, drawing on WithSecure's blog post: AI security is becoming a board-level control because AI agents, shadow AI and ungoverned access are expanding faster than governance can keep pace.

Why it matters: Identity, data and oversight teams now need to govern AI systems as active assets, because unmanaged agents can widen access and attack paths before security is looped in.

By the numbers:

• Gartner expects generative AI to be a factor in 22% of all cyberattacks and data leaks by 2028.

Context

AI security is the practice of protecting the AI systems an organisation uses, the infrastructure that runs them, and the business from attacks that use AI. In this context, the control problem is not only model safety but also discovery, privilege and governance across the services and identities that AI touches.

The challenge is that AI adoption often arrives before security is invited into the decision-making process, which leaves teams reacting after tools, plugins and agents are already in production. That sequencing problem is typical of fast-moving technology rollouts, but the scale of AI makes the gap much wider than in earlier platform shifts.

Key questions

Q: What do teams get wrong when onboarding third parties into identity and access management programs?

A: The most common mistake is treating onboarding as a manual, one-time approval instead of a controlled lifecycle. Teams often overgrant access, skip compatibility testing, rely on informal communication, or miss contract requirements. Those gaps lead to data entry errors, compliance violations, orphaned accounts, and unresolved vulnerabilities that accumulate across the relationship.

Q: Why does shadow AI create a governance gap for IAM and security teams?

A: Shadow AI creates a governance gap because organizations cannot manage systems they do not reliably see. If AI apps, agents, and plugin connections live outside the approved inventory, then policy, risk assessment, and monitoring all start from incomplete assumptions. IAM and security teams need discovery that captures real usage, not only sanctioned assets.

Q: Why do connected AI agents increase the impact of prompt injection?

A: Connected agents expand one poisoned prompt into a broader execution graph. A single malicious instruction can influence planning, trigger tool use, and cascade into email, messaging, device control, or other services. The risk grows when the assistant can move from one application boundary to another without fresh policy checks.

Q: What is the best way to secure AI agents that use SaaS tools?

A: Secure AI agents by giving each agent a unique identity, least-privilege tool permissions, and short-lived delegated credentials such as OIDC tokens or scoped API keys. Bind actions to a human owner, log every tool call, and revoke access when the agent’s task, model, or approval scope changes. Separate read, write, and admin functions, and require step-up approval for sensitive actions.

Technical breakdown

Shadow AI expands the attack surface before security can inventory it

Shadow AI appears when employees, business units or developers adopt AI tools without formal approval or central tracking. That can include browser extensions, SaaS copilots, embedded assistants and agentic workflows that operate outside normal procurement and review. The key risk is not just unsanctioned software, but unmanaged data access and unpredictable runtime behaviour. When the inventory is incomplete, policy, monitoring and incident response are all built on a false picture of what exists. See the AI Agent Observability, Audit and Incident Response Guide.

Practical implication: Build inventory from observed usage and service identity telemetry before setting policy or control boundaries.

AI agents need identity, not just application controls

An AI agent is not merely a feature inside an application. It is a software entity that can make runtime decisions and invoke tools, which means it needs its own identity model, authentication path and access scope. Treating an agent as a background process encourages standing access and poor attribution. Once agents can act across repositories, browsers or SaaS systems, their privilege becomes part of the enterprise identity estate and should be governed that way. See the AI Agent Authorisation Guide.

Practical implication: Assign each agent a unique identity with least privilege and explicit retirement criteria.

Prompt injection and supply-chain compromise target the agent's decision path

Prompt injection works by hiding instructions in content that the model or agent later consumes, causing the system to follow attacker-controlled directions. Supply-chain compromise extends the same problem to MCP servers, plugins and other connected tools, where a trusted component becomes the path for malicious instructions or data theft. These are not classic perimeter attacks. They exploit the trust relationship between the agent, its context and its toolchain. See the MCP Security Guide.

Practical implication: Inspect inputs, tool connectors and context sources as part of the agent threat model, not as external dependencies.

Threat narrative

Attacker objective: The attacker wants to turn trusted AI workflows into a scalable access and data-exfiltration path that security teams discover too late.

1. Entry occurs through unsanctioned AI tools, browser extensions or embedded agents that enter the environment before security review.
2. Credential access and privilege abuse follow when those agents inherit broad service permissions or token scope that exceeds their task requirements.
3. Impact occurs when attackers exploit prompt injection, malicious plugins or over-privileged agents to exfiltrate data, corrupt workflows or accelerate further compromise.

Breaches seen in the wild

• Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI security is now a governance problem, not a tooling problem. The central failure is sequencing: organisations adopt AI first and ask security to govern it after the fact. That means the real control boundary sits at intake, approval and identity assignment, not at the point of incident response. The field should treat AI adoption like any other high-risk capability that requires ownership, review and auditability from the start.

Non-human identities are the missing governance layer in most AI programmes. AI agents behave like active software entities, but many organisations still manage them as if they were ordinary application features. That leaves service identities, tokens and delegated permissions outside the normal lifecycle controls that govern human access. Where practitioners need a practical framing, agentic AI identity is the right lens for registration, delegation and retirement.

Shadow AI sprawl: the hidden spread of unapproved tools and agents is the named concept this post surfaces. It matters because the inventory problem appears before the policy problem, and the organisation cannot secure what it cannot enumerate. Security leaders should assume the visible AI estate is incomplete until discovery is tied to actual usage and service identity telemetry.

Agent trust must be governed at the context and tool layer. Prompt injection and compromised connectors show that AI risk is not only about model outputs, but also about what the agent reads, remembers and calls. That pushes governance into the toolchain, where trust boundaries are often weakest. Practitioners should treat connectors, plugins and MCP-style integrations as part of the control surface, not as ordinary plumbing.

Boards are converting AI into a measurable security mandate. Once AI affects revenue, regulatory exposure and customer trust, it stops being a side project for innovation teams. The governance question becomes whether the enterprise can prove who owns AI risk, which systems are in scope and what controls apply when a model or agent makes a mistake. The field is moving toward accountable AI operations, and identity evidence will sit at the centre of that shift.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Agentic AI Identity Guide

What this signals

Shadow AI will keep outrunning manual governance unless discovery becomes continuous. Organisations that rely on periodic inventories will keep missing browser-based tools, embedded assistants and dormant agents. The practical shift is toward telemetry-driven discovery tied to service identities, because the control that finds the asset has to be the same control that governs it.

Agent identity is becoming the primary enforcement point for AI governance. Once AI systems can call tools, move data and trigger actions, access reviews are no longer enough on their own. Access needs to be time-limited, task-scoped and revoked automatically when the workflow ends, otherwise agent sprawl becomes a standing privilege problem.

Token and permission scope will matter more than model quality. As AI adoption expands, many incidents will come from over-scoped connectors, inherited trust and unmanaged data exposure rather than from the model itself. Programmes that align AI oversight with identity, data classification and monitoring will have a clearer path to control than those waiting for a perfect policy.

For practitioners

• Implement continuous discovery for AI assets Map AI-integrated SaaS, browser extensions, embedded assistants, agents and their service identities before issuing policy or approvals.
• Treat every AI agent as a first-class identity Assign unique identities, least-privilege access and explicit retirement rules to agents that touch repositories, data or business workflows.
• Add security gates to AI intake Require lightweight review before new AI tools reach production, with pre-approved options for common business use cases.
• Extend data governance to agent activity Classify and monitor the data that agents access, generate and move, including structured and unstructured content in transit and at rest.
• Create board metrics for AI risk ownership Report AI security in terms of revenue exposure, regulatory impact and customer trust, with accountability assigned to the teams deploying AI.

Key takeaways

• AI security is now a governance issue because AI adoption is outpacing the organisation's ability to inventory, approve and oversee what is already running.
• The strongest evidence is that non-human identities outnumber human ones by roughly 17 to 1, while only 30% of security leaders at midsize enterprises feel effective at securing generative AI tools.
• Practitioners should start with discovery, then assign identity, access scope and monitoring to every AI system before it reaches production.

Related NHI Mgmt Group resources: AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide · Agentic AI Identity Guide · Agentic AI Security Guide

Key terms

• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• AI Agents: AI agents are autonomous software entities that act within organisational environments and make runtime decisions within assigned boundaries. They can hold identities, authenticate to systems, and exercise permissions, which makes them comparable to other non-human identities that require inventory, governance, and continuous activity monitoring.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and workload identity. It helps security and identity teams translate AI risk into controls they can operationalise across the programme.