AI agents as shadow IT expose a new NHI governance gap

At a glance

What this is: This webinar argues that AI agents are becoming unmanaged non-human identities, with inherited access, persistent OAuth grants, and continuous execution across cloud systems.

Why it matters: IAM, IGA, and PAM teams need to treat agents as identities with lifecycle, privilege, and offboarding requirements, not as configuration settings or isolated automations.

By the numbers:

• 91% of enterprise AI tools operate completely unmanaged outside of formal IT procurement and security review.
• 17 human identities within an enterprise, enterprise, there is now approximately one active AI agent operating across the cloud environment.
• Detectable AI functionality is now present in over 54% of enterprise cloud applications.

👉 Read Grip Security's webinar on why AI agents are the new shadow IT

Context

AI agents are software identities that can inherit permissions, call tools, and keep running after the user who created them has moved on. That makes them an identity governance problem before they become a security incident, because the control question is no longer who clicked approve, but what the agent can still do on its own. In this article, the primary issue is NHI sprawl in agentic environments, not generic SaaS risk.

The webinar frames static posture management as insufficient because agents are not fixed settings inside approved applications. They are delegated identities with OAuth scopes, data access, and persistence that can outlive the original use case. For IAM programmes, that means discovery, authorisation, review, and offboarding have to be applied to the agent itself, not just to the app it touches.

Key questions

Q: What breaks when AI agents are treated like standard human users?

A: You lose visibility into effective permissions, expected behaviour, and real blast radius. Human-centric controls can misclassify normal agent activity as compromise, or miss policy violations that happen entirely within legitimate access. The failure is not only technical, it is governance design that assumes a person is always behind the action.

Q: Why do autonomous AI agents increase shadow IT risk so quickly?

A: They let employees create active software identities in seconds, often outside procurement and security review. Unlike passive apps, agents can execute actions, access data, and keep running continuously. That turns one informal setup decision into a persistent governance problem across identity, authorisation, and lifecycle control.

Q: How do security teams detect AI agent sprawl before it becomes a breach issue?

A: Look for identity-layer signals rather than only approved application lists. Track authentication events, OAuth grants, unusual scope growth, and agents that remain active after the business need has ended. If discovery depends only on posture scans, unmanaged agents will stay invisible until they are already operating against sensitive systems.

Q: When should organisations revoke AI project access?

A: Organisations should revoke AI project access when a contractor leaves, a pilot ends, a role changes, or an identity is no longer needed to operate the workflow. Waiting for periodic cleanup leaves stale access active and makes least privilege mostly theoretical.

Technical breakdown

How autonomous AI agents inherit enterprise permissions

An autonomous AI agent often operates through delegated authorisation. A human user grants OAuth scopes or similar tokens, and the agent can then act across connected SaaS and cloud services with the user's inherited rights. The technical issue is not simply that the tool can connect to multiple systems. It is that the identity grant can persist after the original session, creating a durable access path that is separate from normal interactive login control. That makes the agent a non-human identity with a lifecycle of its own.

Practical implication: classify each agent as a distinct identity and track the scopes it inherited at authorisation time.

Why static posture scanners miss shadow AI

Posture scanners are good at checking known configurations, but autonomous agents are often created inside unsanctioned services or glued together through ad hoc integrations. That means there may be no central record for the scanner to inspect, no stable asset inventory, and no fixed configuration baseline to compare against. The agent can still read data, write files, send messages, or trigger workflows even when the underlying tool never appears in approved application lists. The governance gap is visibility into identity activity, not just application posture.

Practical implication: combine configuration scanning with identity-layer telemetry so agent creation and authorisation events are discoverable.

OAuth scope drift and persistent non-human identity sprawl

Scope drift happens when an agent receives broad permissions at setup and those permissions remain in place long after the original business need has changed. Because agents can operate continuously, permissions that were defensible on day one can become excessive by day 30. The article also highlights orphaned agents, where the human creator leaves or changes role but the agent keeps its grants. That is a lifecycle failure, not a tooling failure, because ownership and revocation were never tied tightly enough to the identity itself.

Practical implication: enforce periodic review and automated decommissioning of unused or orphaned agent grants.

Threat narrative

Attacker objective: The attacker objective is to abuse delegated agent access as a durable foothold for data access, workflow manipulation, or downstream credential exposure.

1. Entry begins when a user authorises an AI agent through delegated OAuth or comparable credentials, giving it access to enterprise data and connected services.
2. Escalation occurs when the agent accumulates broad scopes, persistent access, or cross-platform trust relationships that outlast the original task.
3. Impact follows when the unmanaged agent reads sensitive records, triggers external communications, or acts beyond its intended scope without central oversight.

Breaches seen in the wild

• CoPhish OAuth Token Theft via Copilot Studio — CoPhish campaign exploits Microsoft Copilot Studio agents to steal OAuth tokens via AI-assisted phishing.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agents are becoming the fastest-growing class of unmanaged non-human identity. The article's central point is not that enterprises have another software tool problem, but that they now have identity sprawl with runtime behaviour. Once an agent can inherit scopes, persist beyond the creator's session, and operate across systems, it belongs in NHI governance, not in a general application inventory. Practitioners should treat agent discovery as identity inventory, not software cataloguing.

Identity is the control plane, not the container, for agentic enterprise security. Static posture management assumes the risk is in the application configuration, but the article shows that the real issue is the trust relationship attached to the agent. That relationship can span SaaS platforms, OAuth grants, and background execution, which means app-centric checks miss the thing actually making decisions. The implication is that security teams need to govern delegated identity, not just the host application.

Agentic shadow IT collapses the old boundary between user choice and machine action. Traditional shadow IT assumed an employee picked an unsanctioned app and the app stayed mostly passive. Here, the employee creates an active identity that can continue to act after setup, which means the governance blast radius is much larger. That changes the discipline from software approval to continuous identity lifecycle control, including ownership, review, and offboarding.

Persistent OAuth grants create what we call identity blast radius. When an agent can keep inherited access long after the original approval, one weak grant can fan out across collaboration, storage, and communications systems. The article is right to frame this as a control-plane issue because revocation and scope management become the real security boundary. Practitioners should measure how far one grant can propagate before they assume visibility is adequate.

Access review processes designed for human-paced accounts are too slow for autonomous behaviour. Even when a human is involved at creation time, the agent can keep operating continuously in the background. That means review cadences that depend on periodic human certification will always lag behind agent activity. The governance conclusion is simple: if the agent can keep acting between review cycles, the programme is certifying yesterday's risk.

From our research:

• 91% of enterprise AI tools operate completely unmanaged outside of formal IT procurement and security review, according to the AI Agents: The New Attack Surface report.
• Our research also found that 80% of organisations report AI agents already performing actions beyond intended scope, including access to unauthorised systems, sensitive data sharing, and credential exposure.
• For a broader control lens, see OWASP Agentic AI Top 10 for the risk patterns that map directly to agent governance gaps.

What this signals

Identity-first discovery has become the only credible way to govern agentic sprawl. The article's own numbers point to a market that is already outpacing manual governance, and the operating model has to follow. With 91% of enterprise AI tools unmanaged, teams need to detect agents through authentication and authorisation telemetry rather than hope an app inventory catches up. That is a control design issue, not just a visibility problem.

Identity blast radius is now a measurable programme risk. Once one agent can inherit broad OAuth access, the question is how far the grant can propagate before governance catches up. In this environment, offboarding and scope review need to be treated as continuous controls, not periodic clean-up activities. Security leaders should expect agent lifecycle management to sit beside service account governance in the next wave of IGA maturity.

Shadow AI governance will increasingly converge with NHI governance. That convergence matters because the same lifecycle discipline that applies to service accounts now applies to AI agents that act independently. Organisations that separate these problems into different teams will keep missing orphaned identities, stale scopes, and overbroad permissions. The programme implication is to unify discovery, authorisation, and revocation across human, NHI, and autonomous actors.

For practitioners

• Inventory every AI agent as an identity object Assign ownership, system context, and lifecycle state to each agent so it appears in the same governance record as other non-human identities.
• Map delegated OAuth relationships end to end Record which human user approved the agent, which scopes were granted, and which third-party services can be reached through that grant.
• Revoke unused or overly broad permissions quickly Review agents that only need read access, then remove tenant-wide or write permissions that are not necessary for the task.
• Automate orphaned-agent offboarding Detect agents whose creators have left or changed roles, then decommission associated API keys, tokens, and grants as part of offboarding.
• Add identity-layer telemetry to discovery workflows Use authentication and authorisation signals to find shadow AI that would never appear in a static application posture report.

Key takeaways

• AI agents are emerging as unmanaged non-human identities, which means identity governance now has to cover runtime behaviour, delegated scopes, and offboarding.
• The article's evidence shows the scale is already material, with the majority of enterprise AI tools operating outside formal review and many agents acting beyond intended scope.
• The practical response is not another posture checklist, but identity-first discovery, scope control, and automated lifecycle enforcement for every agent.

Key terms

• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Delegated OAuth Access: Delegated OAuth access is a permission model where an application acts on behalf of a user or workspace after consent is granted. In NHI terms, the app becomes a non-human identity with real reach, so scope, revocation, and monitoring matter as much as the original account credentials.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Orphaned Agent: An orphaned agent is an AI or software identity that still has access but no longer has a clear human owner responsible for its governance. The risk is lifecycle drift, where the access remains active after role changes or departures, leaving accountability and revocation processes incomplete.

What's in the full article

Grip Security's full webinar covers the operational detail this post intentionally leaves for the source:

• The identity-first four-step framework for discovering shadow AI and mapping delegated OAuth relationships.
• The distinction between static posture tools and identity-layer telemetry for agent discovery.
• Operational guidance for offboarding orphaned agents, API keys, and OAuth grants when creators leave or change roles.
• The webinar's examples of how unmanaged agents can read data, trigger workflows, and persist across cloud systems.

👉 The full Grip Security webinar covers identity-first discovery, OAuth mapping, and automated offboarding for AI agents.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity programme, it is worth exploring.