The Shadow Agent Crisis: Your AI Agents Are Now Insider Threats

In June 2025, a security firm showed that a single email could turn Microsoft 365 Copilot against the company running it. Nothing to click. No attachment to open. The email carried hidden instructions, Copilot read them while answering an unrelated question, and it quietly pulled data out of the user's mailbox, Teams, OneDrive, and SharePoint. Microsoft tracked it as CVE-2025-32711, scored it 9.3 out of 10, and patched it. Researchers named it EchoLeak, the first documented zero-click prompt injection against a production AI system.

Here is the part that matters. Copilot was not rogue shadow software. It was sanctioned, licensed, and trusted, and it held real access to real data. The attacker never needed a password, because the agent already had one.

That is the distinction I want to draw. Most people worry about shadow AI: an employee pasting a customer list into ChatGPT. That is a real problem, and I covered the broader governance side in the shadow AI governance crisis. But there is a second, sharper problem sitting underneath it, and almost nobody has named it cleanly.

Shadow AI is a person doing something risky. A shadow agent is an identity with credentials, doing things on its own.

After founding a CIAM platform that scaled to serve over a billion users, I thought I understood identity at scale. Watching enterprises hand autonomous agents the keys to production, with the controls they built for human contractors, is like bolting a jet engine onto a bicycle frame.

Shadow AI Is a Person. A Shadow Agent Is an Identity

The reason this matters is that the two problems fail in completely different ways.

When an employee pastes data into an unsanctioned chatbot, the risk is disclosure. The boundary is the copy and paste. It is bad, but it is bounded: one person, one prompt, one leak.

A shadow agent is not a person and not a tab. It is a running identity that holds API keys, OAuth tokens, or service-account credentials, reads input nobody screened, and then acts. It sends the email. It moves the money. It edits the record. It calls the next agent. It does all of that on a schedule, at machine speed, without anyone in the loop.

So the right mental model for a shadow agent is not "an app my team spun up." It is closer to an unmanaged employee who was handed admin rights on their first day, never sleeps, never questions an instruction, and cannot be fired because no one remembers deploying them.

Everything I built at that CIAM platform assumed a human on the other end. Sessions timed out because people log off. Anomaly rules worked because human behavior is bounded. If I were architecting that system today for a fleet of agents, I would throw out those assumptions entirely. The identity model is what breaks, not the model weights.

Why a Shadow Agent Is a New Class of Insider Threat

Start with the scale, because it is worse than most leaders think.

CyberArk's 2025 Identity Security Landscape, a survey of 2,600 security decision makers at organizations with 500 or more employees, found that machine identities now outnumber human identities by 82 to 1. Forty-two percent of those machine identities have access to sensitive data. And yet 88 percent of organizations still define only human identities as "privileged users." Sixty-eight percent report having no security controls in place for AI and large language models at all.

Read those numbers together. The population that already dwarfs your workforce, and increasingly holds sensitive access, is the exact population your privileged-access program does not cover.

Three properties make an agent a worse insider than any employee:

It never logs off. A human contractor with database access goes home. An agent with the same access is querying at 3 a.m. on a Sunday, during the exact window when no one is watching. Every second it runs is a second it can be turned.

It is implicitly trusted. When a person requests the finance database at midnight, it raises a flag. When an agent does the same thing, the response is "it is doing its job." The whole point of deploying it was to remove the human who would have hesitated.

Its attack surface is language. A human insider needs a motive. An agent needs only a poisoned input. You do not have to bribe it or phish it. You put instructions where it will read them, and it follows them, because following instructions is the entire product.

How Shadow Agents Actually Get Compromised

These are not hypotheticals. In December 2025, OWASP published its Top 10 for Agentic Applications, built with more than 100 practitioners, and the failure modes below map directly onto it.

1. Hijacking the agent through its inputs

EchoLeak is the proof of concept the whole industry needed. A hidden prompt, delivered through a normal channel, hijacks the agent's goal and turns its legitimate tools into an exfiltration pipeline. OWASP calls these ASI01 Agent Goal Hijack and ASI02 Tool Misuse. The agent is not breached in the classic sense. It is convinced. And because it is authorized to touch the data, nothing downstream sees an intrusion, only an authorized agent doing authorized things.

2. The credentials are already leaking

Agents authenticate with secrets, and those secrets are hemorrhaging. GitGuardian's State of Secrets Sprawl 2026 found 28.65 million new hardcoded secrets committed to public GitHub in 2025 alone, a 34 percent jump year over year. Leaks tied specifically to AI services rose 81 percent. Researchers found 24,008 secrets exposed in Model Context Protocol configuration files, the plumbing that wires agents to their tools. Worst of all, roughly 64 percent of credentials confirmed valid a year earlier were still valid, meaning they were never rotated after exposure. This is OWASP ASI03, Identity and Privilege Abuse. A leaked, long-lived, over-permissioned agent key is a master key with no expiry date.

3. Poisoning what the agent remembers

Many agents keep persistent memory across sessions to feel personalized. Feed one a false "policy" as a customer, and it can store that as fact and act on it days later for a different request. OWASP tracks this as ASI06, Memory and Context Poisoning. Unlike a prompt injection that ends when the session ends, a poisoned memory persists. The agent does not get attacked again. It simply remembers the lie.

4. Turning one agent against the next

Agents increasingly call other agents. A research agent feeds an analysis agent that feeds a distribution agent. Poison the first one's source, and the malicious instruction rides the chain, laundered into "high-confidence analysis" by the time it reaches a human. OWASP calls this ASI07, Insecure Inter-Agent Communication. When the links in the chain trust each other by default, one bad input compromises all of them.

What I Would Do Before the First Headline Breach

Generic advice ("use least privilege, add monitoring") is true and useless on its own. Here is the specific order I would work in.

Inventory the agents first. You cannot govern what you cannot see. Automated discovery, plus a direct question to every team: what agents are running, what can each one reach, what credentials does it hold, and who owns it? You will find agents nobody remembers deploying. That is the shadow in shadow agent.

Treat every agent as a privileged identity. This is the single mindset change that closes the biggest gap in the CyberArk data. If 42 percent of machine identities touch sensitive data, then defining only humans as privileged is a policy fiction. Put agents in the same governance program as your admins, with the same reviews and the same accountability.

Kill long-lived credentials. The static API key sitting in an environment variable for eighteen months is the vulnerability the secrets-sprawl numbers are describing. Move to short-lived, automatically rotated credentials, scoped to a single task. If a key leaks, it should already be dead.

Enforce least privilege and just-in-time access. An agent should hold the narrowest permission for the task in front of it, granted when needed and revoked when done. Broad standing access is what turns a single hijack into a company-wide incident.

Keep a human on high-impact actions. Not every action, that would erase the point of the agent. Just the ones that move money above a threshold, touch regulated data, change production, or speak to the outside world with your authority. Automate the million small decisions. Gate the handful that can end a career. This mirrors risk-based authentication: raise the bar exactly where the stakes rise.

Monitor the identity, not just the logs. Baseline what normal looks like for each agent, then alert on drift: new systems it never touched, data volumes it never moved, actions at hours it never runs. Traditional logging tells you what happened after the fact. You want the anomaly while it is happening.

None of this is exotic. It is the difference between authentication and authorization applied to machines, and it is the same discipline behind the CIAM and IAM distinction I have written about for years. The mechanics are known. What is new is the requirement to point them at non-human identities that outnumber your staff by nearly two orders of magnitude.

The Uncomfortable Symmetry

The value of an agent and the danger of an agent come from the same property: autonomy. You cannot make it useful enough to deploy and safe enough to ignore at the same time. Something has to hold the middle, and right now, for most organizations, nothing does.

The agents are already running. The credentials are already leaking. The first zero-click exploit already has a CVE number. The security architecture is the only piece still being retrofitted, and the gap between the two is exactly where the first headline breach will happen.

The question is not whether your organization runs shadow agents. It does. The question is whether you can name them before an attacker does.

Key Takeaways

• Shadow AI is a person doing something risky. A shadow agent is a credentialed identity acting on its own, and it fails in a far worse way.
• Machine identities now outnumber humans 82 to 1 (CyberArk 2025), 42 percent touch sensitive data, yet 88 percent of orgs still call only humans "privileged."
• EchoLeak (CVE-2025-32711, CVSS 9.3) proved a single email can hijack a trusted agent and exfiltrate data with zero clicks.
• Agent credentials are leaking at scale: 28.65M secrets hit public GitHub in 2025, AI-service leaks rose 81 percent, and 24,008 secrets sat in MCP config files (GitGuardian 2026).
• The core failure modes map to OWASP's 2026 Top 10 for Agentic Applications: goal hijack, tool misuse, identity abuse, memory poisoning, and insecure inter-agent communication.
• Fix order: inventory agents, treat every agent as privileged, kill long-lived keys, enforce least privilege and just-in-time access, keep a human on high-impact actions, monitor the identity.

Working on identity for AI agents? My CIAM Compass knowledge portal covers authentication, authorization, and access models that scale from humans to machines.

Need AI visibility for your B2B SaaS? GrackerAI helps cybersecurity and B2B SaaS companies get cited by ChatGPT, Perplexity, and Google AI Overviews through Generative Engine Optimization.

Deepak Gupta is the co-founder and CEO of GrackerAI. He previously founded a CIAM platform that scaled to serve 1B+ users globally. He writes about AI, cybersecurity, and digital identity at guptadeepak.com.