TL;DR: C1.ai says shadow AI discovery can surface unauthorized AI agents, MCP servers, long-lived keys, and plaintext API tokens across cloud and endpoint environments, then route them into identity governance workflows. The deeper issue is not detection but the assumption that only approved apps and human sessions need lifecycle control, which no longer holds.
At a glance
What this is: C1.ai’s announcement frames shadow AI discovery as a way to inventory unauthorized AI agents, MCP servers, and exposed credentials, then govern them through the same lifecycle as workforce access.
Why it matters: IAM, NHI, and PAM teams need to see why discovery alone is not enough, because AI-adjacent identities now create ownership, certification, and offboarding problems that traditional tools were not built to absorb.
By the numbers:
- One in five organisations reported a breach due to shadow AI, and 97% of those breached through an AI model or application lacked proper AI access controls, according to IBM's 2025 Cost of a Data Breach Report.
👉 Read C1.ai's analysis of shadow AI discovery and NHI governance
Context
Shadow AI discovery is the practice of finding AI agents, tools, MCP servers, and credentials that exist outside approved governance. In this article, the problem is not just visibility gaps but the fact that AI-created access often appears in places existing identity controls do not monitor well, including cloud connectors, local configs, and plaintext environment files.
C1.ai’s announcement ties that discovery problem directly to identity governance. Once an unauthorised agent or MCP endpoint is discovered, the question becomes who owns it, how it is approved, and how it is certified or removed, which is the same lifecycle problem IAM and NHI programmes already manage for other non-human identities.
Key questions
Q: What breaks when shadow AI is not discovered early?
A: Teams lose sight of which agents exist, what they can reach, and which credentials they use. That creates blind spots in audit trails, incident response, and offboarding, especially when agents are created locally or disappear after a single task. Discovery failure becomes governance failure once the identity cannot be traced back to an owner.
Q: Why does shadow AI create a different governance problem than sanctioned applications?
A: Sanctioned applications usually sit inside established procurement, ownership, and review processes. Shadow AI often appears first as an unmanaged agent, token, or MCP endpoint, so the control gap is lifecycle governance rather than simple detection. That is why discovery must feed assignment, review, and offboarding, not just alerting.
Q: How do security teams know if shadow AI is actually under control?
A: Security teams know shadow AI is under control when they can inventory every agent, model workflow, and tool connection, then map each one to an owner and access scope. If they cannot explain who owns it, what it can access, and when it was last reviewed, it is not controlled.
Q: What is the difference between shadow AI discovery and NHI governance?
A: Discovery finds the asset. NHI governance controls its lifecycle. In practice, shadow AI discovery tells you what exists across cloud and endpoint surfaces, while NHI governance determines who owns it, who approved it, what it can reach, and when it should be removed.
How it works in practice
How shadow AI discovery maps AI-adjacent identities
Shadow AI discovery combines inventory, correlation, and ownership assignment across cloud and endpoint telemetry. In the cloud, connectors can find unowned agents and the MCP servers, APIs, and data stores they can reach. On endpoints, scans can surface local MCP configuration files, unsanctioned copilots, and tokens in plaintext .env files. The technical point is that discovery is not just asset finding. It is identity discovery for software that can authenticate, inherit reach, and expose standing access outside the normal approval chain.
Practical implication: treat discovery output as an identity inventory feed, not a security finding queue.
Why MCP visibility changes the NHI risk model
Model Context Protocol matters because it exposes a structured route from an AI agent to tools and data sources. That makes MCP servers, API tokens, and linked service accounts part of the same trust chain. When an AI agent can create or accumulate credentials and then use MCP connectivity to reach systems, the identity boundary shifts from a named account to a tool-enabled execution path. The governance issue is not just whether an agent is approved, but whether its connected credentials and reachable services are owned, scoped, and revocable.
Practical implication: map every discovered MCP connection to an owner, a scope, and a revocation path.
Why lifecycle governance matters more than one-time blocking
The article’s central governance move is to turn a discovery event into a managed access item. That means assignment, request, approval, certification, and de-provisioning inside the same governance fabric used for workforce access. This is the part many programmes miss: a block without ownership does not create accountability, and a list without review does not create control. For AI-adjacent NHIs, the operational question becomes whether the identity can move through the same lifecycle states as any other governed account.
Practical implication: extend access review and offboarding workflows to discovered AI agents and their credentials.
NHI Mgmt Group analysis
Shadow AI discovery is now an identity-governance function, not just a detection feature. The article shows that once AI agents, MCP servers, and exposed credentials can be discovered, the real control question is ownership and lifecycle. That puts shadow AI in the same governance class as other non-human identities, where inventory only matters if it leads to approval, certification, and offboarding.
Lifecycle governance is the missing control plane for agentic enterprises. The article makes clear that discovery without assignment leaves organisations with visibility but no accountability. A discovered agent or token must be treated as an access item with a steward, review cadence, and revocation path, otherwise the enterprise has simply replaced blind spots with unmanaged facts.
Long-lived secret exposure is the named concept that should anchor this market. AI-adjacent identities often accumulate standing keys and tokens faster than security teams can inventory them. The operational problem is not that AI is invisible in theory, but that its credentials persist across cloud and endpoint surfaces long enough to become governance debt, and practitioners need controls that bind discovery to removal.
MCP visibility widens the NHI boundary from accounts to execution paths. Once an agent can reach tools, APIs, and data stores through MCP, the governed object is no longer only the account. The chain of trust now includes what the agent can invoke, which means NHI governance has to consider connected services as part of the identity perimeter.
Shadow AI is exposing a mismatch between approval-era controls and runtime identity sprawl. Existing tools can miss agents because they assume identities are either human sessions or sanctioned applications. That assumption no longer fits AI-adjacent systems that self-authenticate, acquire credentials, and persist outside standard provisioning flows, so practitioners should re-evaluate where ownership is actually enforced.
From our research library:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- One in five organisations reported a breach due to shadow AI, and 97% of those breached through an AI model or application lacked proper AI access controls, according to IBM's 2025 Cost of a Data Breach Report.
- Read next: Ultimate Guide to NHIs — Key Research and Survey Results
What this signals
Lifecycle control is the real test of shadow AI governance. Discovery tools can surface agents, MCP servers, and credentials, but the programme only becomes defensible when those findings move into the same owner-assignment and review process used for other non-human identities. That is the boundary between visibility and governance.
Ephemeral discovery still leaves durable risk when secrets are long-lived. If credentials persist across endpoints and cloud connectors after an agent is found, the security issue is not the scan itself but the persistence of access. Teams should watch for discovery flows that do not automatically trigger revocation or certification.
For practitioners
- Map AI-adjacent identities into your identity inventory Create a single inventory for discovered agents, MCP servers, API tokens, and service accounts so each item has an owner and an access scope.
- Extend certification to discovered non-human access Route newly found AI agents and connected credentials through the same access review and approval process used for other non-human identities.
- Scan endpoints for plaintext AI credentials Check local MCP configs, .env files, and developer workstations for tokens and keys that create unmanaged access paths.
- Remove standing access from over-permissioned service accounts Revoke or reduce privileges where discovered agents rely on service accounts that can reach more systems than the task requires.
- Tie discovery to offboarding Make sure any discovered AI agent or credential can be de-provisioned through a documented lifecycle process instead of a one-time block.
Key takeaways
- Shadow AI is no longer just an observability issue because discovered agents and credentials now need governance, ownership, and offboarding.
- The article ties shadow AI risk to real-world breach outcomes and to exposed credentials in MCP-related workflows, which makes lifecycle control the key operational gap.
- Programmes that stop at detection will keep finding the same problem, while programmes that attach ownership and review to discovery can actually reduce exposure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article highlights plaintext tokens, exposed keys, and hidden credentials on endpoints and in cloud workflows. |
| NHI-03 — Vulnerable Third-Party NHI | The post addresses unowned agents and external AI tooling that enter the enterprise without clear governance. | |
| NHI-05 — Overprivileged NHI | The article flags over-permissioned service accounts and reachable MCP paths as a core exposure. | |
| Recommendation — Scan for exposed AI credentials and revoke any secret found outside governed storage. Inventory third-party AI identities and verify ownership before allowing access to enterprise resources. Reduce AI-adjacent access scopes to the minimum required for each discovered workflow. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article concerns AI agents accumulating credentials and using them outside approved governance. |
| Recommendation — Map agent identities and their privileges to approved boundaries before permitting tool access. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Exposed secrets and reachable MCP paths can lead from credential exposure into broader access. |
| Recommendation — Track discovered secrets as credential-access risk and inspect resulting reach for lateral movement paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The post is about governing permissions and entitlements for discovered AI-adjacent identities. |
| Recommendation — Apply entitlement controls to discovered AI agents, tokens, and service accounts before they reach production. | ||
Key terms
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Lifecycle Governance: Lifecycle governance is the set of controls that cover creation, assignment, review, rotation, and retirement of identities and credentials. For NHIs, it is the difference between a temporary automation asset and a persistent access risk. Strong lifecycle governance keeps ownership and expiry tied to actual business use.
What's in the full announcement
C1.ai's full post covers the operational detail this post intentionally leaves for the source:
- How the discovery flow connects cloud connectors, endpoint scans, and governance workflows
- What gets assigned when an agent, token, or MCP server is found without an owner
- How discovered items move into approval, certification, and de-provisioning steps
- Why the vendor frames shadow AI as a lifecycle problem rather than a point-in-time detection problem
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 28, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org