TL;DR: Hidden AI tools, browser extensions and agentic identities remain outside normal control planes until organisations can see them, according to WithSecure, making visibility the first prerequisite for governing data exposure, excess privilege and browser-level abuse. Discovery has to move ahead of remediation because unmanaged AI creates risk before policy can reach it.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on WithSecure's blog post: Shadow AI, AI browser extensions and agentic identities become governable only after inventory and identity visibility exposes them.
Why it matters: IAM, NHI and security teams cannot govern what they cannot inventory, and hidden AI use creates data, privilege and compliance risk before controls can engage.
Context
Shadow AI becomes a governance problem when employees adopt AI tools, browser extensions or agent-like workflows outside approved channels. The issue is not only unsanctioned software use, but the absence of inventory, identity and browser-level visibility that lets those tools operate beyond normal IAM and security oversight.
For non-human identity programmes, the gap is familiar: credentials, tokens and service accounts often exist before anyone can govern them. In AI-heavy environments, that same visibility problem now extends to assistants, coding tools and browser extensions, which can all touch corporate data before security teams know they exist. Shadow AI and AI agent discovery is the natural starting point.
Key questions
Q: How do organisations stop shadow AI from creating access and data exposure risk?
A: Organisations need explicit usage policy, service discovery, and data access boundaries so employees know what is approved and what is not. Then they must monitor for unauthorised tools, unusual data flows, and unowned identities. Without that combination, shadow AI becomes invisible NHI sprawl with unclear accountability.
Q: Why do AI browser extensions create higher data exposure risk than standard extensions?
A: AI browser extensions often request broad access to page content, messages, or input fields so they can provide context aware features. That access can expose personal data, credentials, and confidential business information to collection, interception, or misuse. If the extension is poorly governed, the risk increases further because model behavior can be influenced by unsafe prompts, biased outputs, or malicious manipulation.
Q: How should teams govern agent credentials in production?
A: Treat each agent credential as a governed identity with a clear owner, a narrow role, and a defined expiry. Use short-lived issuance where possible, enforce revocation automatically, and review the permissions on every workflow change. If the identity cannot be traced to a business function, it is already overexposed.
Q: What is the difference between application inventory and identity inventory in AI environments?
A: Application inventory tells you what software exists, while identity inventory tells you what can act, what it can reach, and under which delegated trust relationships. In AI-heavy environments, the second view is the one that exposes real security risk.
Technical breakdown
How shadow AI becomes an inventory problem
Shadow AI is easiest to miss when tools are delivered as browser services or lightweight apps that never pass through standard software deployment. Traditional inventory systems often rely on installed packages, endpoint agents or approval workflows, so they miss tools that users access directly in the browser or through approved SaaS accounts. Once a tool is absent from inventory, it is also absent from review, restriction and exception handling. That is why discovery is the first control layer here: not because inventory solves the risk, but because every other control depends on knowing the tool exists.
Practical implication: Treat software inventory as the intake point for AI governance, not as a reporting exercise.
Why AI browser extensions create a browser-level trust problem
AI browser extensions can request broad page access so they can read, transform or summarise content across sites. That permission model is powerful because it puts the extension inside the user’s active session, where it can see content, forms and sometimes credentials. If the extension is compromised later, the same permissions become a ready-made path to data capture. This is not a hard drive scanning problem; the payload may be loaded dynamically after installation, which is why browser-runtime visibility matters more than static file inspection. See the Browser Extension Security Guide.
Practical implication: Monitor extension permissions and runtime behaviour in the browser, not just whether the extension is installed.
What agentic identity visibility changes in Entra ID
Agentic identities are the credentials, tokens or service accounts used by AI agents, chat assistants and coding assistants to act against systems. Once those identities are surfaced in a central identity plane, they can be tied to owners, access scope and lifecycle controls instead of lingering as invisible exceptions. The underlying issue is not simply that the identities exist, but that they often accumulate broader standing privilege than the humans who created them. Visibility makes that overreach measurable, which is the prerequisite to governance. See the AI Safety vs AI Security Guide.
Practical implication: Inventory agent credentials with the same discipline used for other privileged non-human identities.
Threat narrative
Attacker objective: The attacker objective is to harvest corporate data, credentials or code through an unseen AI tool or extension that already has user trust.
- Entry occurs when employees introduce shadow AI tools or browser extensions into the environment without IT approval or inventory coverage.
- Credentialed access expands when those tools are assigned tokens, service accounts or browser permissions broad enough to read content across sites and systems.
- Impact follows when a compromised or over-permissioned tool can extract sensitive data, credentials or proprietary code from active work sessions.
Breaches seen in the wild
- Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Shadow AI is now an inventory problem before it is a policy problem. Security teams cannot govern tools that sit outside discovery, and browser-delivered AI makes that gap larger because it bypasses traditional software deployment paths. The practical consequence is that AI governance starts with asset visibility, not with approval workflows or policy wording.
Browser-level control is the missing layer for AI use inside daily work. Many AI extensions live inside the same session as the user, which means their permissions can reach content, forms and credentials that endpoint scanning never sees. That shifts the control question from installed software to runtime browser trust, which is where the risk actually materialises.
Agentic identities create a standing privilege problem that looks like old NHI sprawl in a new wrapper. The credentials used by AI assistants and coding tools often grow faster than the organisation can assign ownership, review scope or retire access. That is why the same lifecycle discipline used for service accounts now has to extend to AI-linked identities as well.
Confidence with AI depends on visibility into what AI is already doing. WithSecure frames this as a dual problem: defending at AI speed and proving that AI is controlled across the estate. The named concept is visibility-led AI governance: if the organisation cannot inventory the tool, it cannot constrain the behaviour, and practitioners should treat that as a governance failure rather than a tooling gap.
Machine identity sprawl makes AI visibility a board-level issue, not a niche security task. When machine identities vastly outnumber human ones, any new AI tool that creates its own credentials adds to an already opaque estate. The implication for practitioners is clear: identity governance and AI security now overlap at the discovery layer, and they should be managed as one programme.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Shadow AI and AI Agent Discovery Guide
What this signals
Visibility-led AI governance: AI programmes now need a discovery layer that spans software, browser activity and identity, because policy cannot govern what inventory does not surface. The next operational question is not whether AI is present, but whether its tool use and credentials are measurable enough to assign ownership and controls.
Browser-delivered AI use will continue to outpace traditional endpoint assumptions, especially where extensions can see active sessions and page content. Security teams should expect the browser to become a primary governance surface for AI usage, not a secondary telemetry source.
The service-account lesson from NHI programmes applies directly to AI-linked identities: if ownership and lifecycle are unclear, privilege accumulates silently. That means discovery, recertification and offboarding logic have to follow the identity, not the technology label.
For practitioners
- Build a unified AI inventory Surface shadow AI, browser extensions and AI-linked identities in the same discovery process so security and IAM teams can see them together.
- Review browser extension permissions Identify extensions that can read or modify content across sites, then classify them by data reach and runtime behaviour.
- Map AI identities to owners Tie AI agents, assistants and coding tools to accountable business owners, named approvers and explicit access scope.
- Separate visibility from remediation Treat discovery as the first control step, then decide which AI tools need restriction, review or removal based on actual usage.
- Extend identity governance to AI credentials Apply the same lifecycle discipline to agent tokens, service accounts and integrations that you already use for privileged non-human identities.
Key takeaways
- Shadow AI becomes a governance issue when it sits outside inventory, browser monitoring and identity visibility.
- AI browser extensions can reach sensitive content at runtime, which makes static endpoint scanning insufficient.
- Agentic identities need the same ownership, scope and lifecycle controls used for other privileged non-human identities.
Related NHI Mgmt Group resources: Shadow AI and AI Agent Discovery Guide · Browser Extension Security Guide · AI Safety vs AI Security Guide · Top 10 Shadow AI Risks
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | Shadow AI tools and extensions create unmanaged third-party identity and access pathways inside the estate. |
| NHI-05 — Overprivileged NHI | Agent identities and AI-linked service accounts often carry excess standing privilege beyond their task scope. | |
| Recommendation — Inventory external AI tools and integrations, then verify ownership and access before allowing production use. Review AI-linked identities for excess privilege and reduce access to the minimum required for each task. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical Devices and Systems Inventoried | The article centres on discovering AI tools and identities before they can be governed. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | Visibility into agent credentials only matters if the resulting permissions can be reviewed and constrained. | |
| Recommendation — Extend asset inventory to capture AI tools, browser extensions and AI-linked identities across the environment. Map AI identities to explicit permissions and remove access that is not tied to a documented business need. | ||
| CIS Controls v8 | CIS-2 — Inventory and Control of Software Assets | Shadow AI is fundamentally a software inventory gap, including browser-delivered tools not formally installed. |
| Recommendation — Maintain an authoritative software inventory that includes AI apps and browser extensions used on managed endpoints. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | Compromised extensions and agent identities can be used to steal credentials and extract sensitive data. |
| Recommendation — Map AI extension abuse to credential access and exfiltration behaviours in detection and hunting workflows. | ||
Key terms
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Agentic Identity: An agentic identity is a non-human identity used by an autonomous system that can act, call tools, and access data with execution authority. It needs the same governance discipline as other privileged identities, plus runtime context, ownership mapping, and revocation paths.
- Browser Extension: A browser extension is a small add-on that changes how a web browser works or looks for a user. In security and identity contexts, it can read page content, intercept requests, access sessions, and interact with web apps, so its permissions, origin, and lifecycle need tight governance.
- Software inventory: A current, authoritative record of the applications, versions, and dependencies running across an organisation. It is the baseline control for lifecycle management because teams cannot retire, patch, or isolate what they cannot reliably see.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org