Notifications
Clear all
Topic starter
14/09/2026 10:09 am
TL;DR: Autonomous AI agents are behaving like the next wave of shadow IT because they inherit user credentials, persistent OAuth permissions, and continuous execution rights across enterprise systems, according to Grip Security. The governance gap is that static posture tools cannot see or lifecycle-manage these non-human identities once they spread beyond sanctioned environments.
NHIMG editorial — based on content published by Grip Security: Why AI Agents Are the New Shadow IT: Securing Non-Human Identities in the Agentic Enterprise
By the numbers:
- 91% of enterprise AI tools operate completely unmanaged outside of formal IT procurement and security review.
- 17 human identities within an enterprise, enterprise, there is now approximately one active AI agent operating across the cloud environment.
- Detectable AI functionality is now present in over 54% of enterprise cloud applications.
Questions worth separating out
Q: What breaks when AI agents are treated like standard human users?
A: You lose visibility into effective permissions, expected behaviour, and real blast radius.
Q: Why do autonomous AI agents increase shadow IT risk so quickly?
A: They let employees create active software identities in seconds, often outside procurement and security review.
Q: How do security teams detect AI agent sprawl before it becomes a breach issue?
A: Look for identity-layer signals rather than only approved application lists.
Practitioner guidance
- Inventory every AI agent as an identity object Assign ownership, system context, and lifecycle state to each agent so it appears in the same governance record as other non-human identities.
- Map delegated OAuth relationships end to end Record which human user approved the agent, which scopes were granted, and which third-party services can be reached through that grant.
- Revoke unused or overly broad permissions quickly Review agents that only need read access, then remove tenant-wide or write permissions that are not necessary for the task.
What's in the full article
Grip Security's full webinar covers the operational detail this post intentionally leaves for the source:
- The identity-first four-step framework for discovering shadow AI and mapping delegated OAuth relationships.
- The distinction between static posture tools and identity-layer telemetry for agent discovery.
- Operational guidance for offboarding orphaned agents, API keys, and OAuth grants when creators leave or change roles.
- The webinar's examples of how unmanaged agents can read data, trigger workflows, and persist across cloud systems.
👉 Read Grip Security's webinar on why AI agents are the new shadow IT →
AI agents as shadow IT: is your identity control plane ready?
Explore further
14/09/2026 10:10 am
AI agents are becoming the fastest-growing class of unmanaged non-human identity. The article's central point is not that enterprises have another software tool problem, but that they now have identity sprawl with runtime behaviour. Once an agent can inherit scopes, persist beyond the creator's session, and operate across systems, it belongs in NHI governance, not in a general application inventory. Practitioners should treat agent discovery as identity inventory, not software cataloguing.
A few things that frame the scale:
- 91% of enterprise AI tools operate completely unmanaged outside of formal IT procurement and security review, according to the AI Agents: The New Attack Surface report.
- Our research also found that 80% of organisations report AI agents already performing actions beyond intended scope, including access to unauthorised systems, sensitive data sharing, and credential exposure.
A question worth separating out:
Q: When should organisations revoke AI project access?
A: Organisations should revoke AI project access when a contractor leaves, a pilot ends, a role changes, or an identity is no longer needed to operate the workflow. Waiting for periodic cleanup leaves stale access active and makes least privilege mostly theoretical.
👉 Read our full editorial: AI agents as shadow IT expose a new NHI governance gap
