Shadow AI: the agents already running that nobody has inventoried
Shadow AI is any AI system in use inside an organisation without review, approval or oversight from the people accountable for it — a department's own assistant, a model wired into a production workflow by one engineer, an agent calling internal APIs on a key nobody tracked. The agentic form is the harder one: it does not only generate text, it takes actions. You find it by instrumenting the frameworks agents are built on and recording what runs, not by surveying the teams who built them. A governance baseline does exactly that with enforcement switched off, so the first thing you get is an inventory rather than an outage.
Shadow AI is not shadow IT with a model in it
The controls that find unapproved software were built for things that were bought and things that hold data. An agent is written, and what it holds is permission.
It acts, it does not only answer
An unapproved SaaS tool holds data. An unapproved agent calls tools, mutates records and spends money. The question is not what it knows, it is what it is allowed to do.
It is written, not bought
Procurement catches vendors. It does not catch forty lines of Python a team wired to an internal API, which is how most agents in production started.
A survey will not find it
Asking teams what they are running returns what they remember and what they are willing to say. Instrumenting the frameworks returns what actually ran.
There is nothing to show afterwards
When an agent nobody registered takes an action someone later asks about, there is no record of what it saw, what it decided or why — because nothing was recording.
Four steps, in the order you do them
This is the shipped embedded gateway in its observe-only configuration. No trial key, no account, no change to how your agents behave.
Instrument, without changing the agents
The auto-instrumenter patches OpenAI, LangChain and LangGraph in place, so agents that nobody is maintaining still report. One call puts the patches back.
from agentrust_sdk import auto_instrument auto_instrument() # roll back with remove_patches()
Run the pipeline with enforcement off
Validation, confidence, risk and decision all run and all record. Nothing is blocked. An inventory exercise that stops production is an inventory exercise nobody repeats.
from agentrust_sdk import embed_gateway, harness
embed_gateway() # in-process gateway on :8765
@harness(agent_id="refund-agent", block_on_block=False)
def refund_agent(user: str, input: str) -> dict:
... # unchangedLet it run long enough to be representative
A day of traffic finds the agents that run constantly. A fortnight finds the month-end job, the escalation path and the agent one team uses on Fridays.
agentrust report --since 14d
Read the list you could not previously write
Every agent that executed, the framework it runs on, the tools it reached, what it would have been stopped doing, and how its traffic spread across the risk tiers.
# agent_id · framework · runs · would-block · risk tier mix
The full procedure, with the Python and TypeScript variants, is in the embedded quickstart, and the page that walks the offer end to end is the governance baseline.
Four things you cannot get from asking
Which agents exist, and on what
The discovery engine connects to LangGraph, CrewAI, OpenAI Agents, Claude Agents, MCP tool servers and custom Python or Node.js agents, and maps the action surface each one reaches.
What they would have been stopped doing
The block rate, per agent and per rule, from the same deterministic checks that would run in enforcing mode — schema, evidence grounding, tool trust, contradiction, consistency and active policy.
How the traffic spreads across risk
Each execution gets a risk tier — low, medium, high or critical — derived from the validation flags, the confidence score and the business exposure of the action.
A record that starts on day one
Every run is appended to the audit ledger with the full execution envelope: agent id, framework, SDK version, input, output, engine scores and the decision that was reached.
An inventory is not a decision — it is what makes three of them possible
Most of what a first run surfaces falls into one of three piles, and each pile has a different next step.
Agents that should not have been running
Retire them. The ledger is the evidence that they existed and what they did, which is the part a reviewer will ask for after they are gone.
Agents that should run, but have never been tested
Put them through certification before enforcement: prompt injection, jailbreak, tool abuse, memory poisoning and role escalation, plus repeated runs for variance.
Agents that are fine, and now need a policy
Turn enforcement on for them. Each action is then approved, escalated to a human, or blocked against a versioned contract instead of against nothing.
For the control set these three sit inside, and the standards each one answers to, see agentic AI governance. For the risk taxonomy the discovery problem belongs to, see the OWASP agentic crosswalk.
The obvious questions
- What is shadow AI?
- Shadow AI is any AI system in use inside an organisation without the review, approval or oversight of the people accountable for it. The agentic form is the one that matters most: an agent does not only produce text, it calls tools and takes actions against real systems, so an agent nobody registered is an action surface nobody governs.
- How is shadow AI different from shadow IT?
- Shadow IT is usually something bought — an unapproved SaaS account, a personal cloud subscription — and procurement and SSO logs find most of it. An agent is usually something written, inside a repository that is already approved, against APIs that are already approved. The artefact that gives it away is execution, not a purchase order.
- How do you find AI agents nobody registered?
- By instrumenting the frameworks they are built on rather than surveying the people who built them. AgentTrust's auto-instrumenter patches OpenAI, LangChain and LangGraph in place, and the discovery engine connects to LangGraph, CrewAI, OpenAI Agents, Claude Agents, MCP and custom Python or Node.js agents. What executes gets recorded, whether or not anyone declared it.
- Does finding them mean blocking them?
- Not at this stage, and deliberately so. The governance baseline runs the full pipeline with block_on_block=False: every action is validated, scored and recorded, and none is stopped. Enforcement is a later, separate decision you make per agent once you know what you have.
- Does any of this data leave our network?
- No. The embedded gateway runs inside your own process and persists to local SQLite. There is no API key because there is no account, and no egress to switch off because there is none — the same component used for air-gapped deployments.
- What does shadow AI have to do with the OWASP agentic risks?
- An agent nobody has inventoried is ASI10, Rogue Agents, in the OWASP Top 10 for Agentic Applications — an agent acting while appearing legitimate. Discovery is the control that makes the rest of the list addressable, because a risk you cannot enumerate is a risk you cannot assign.
