# Shadow AI agents: what happens when agents use employee logins > Surveys from SailPoint and the Cloud Security Alliance show many companies can't tell agent activity from human activity. Why that happens, and what to do. - URL: https://www.smith.seattlecompute.com/blog/shadow-ai-agents - Published: 2026-10-29 - Type: article - Topics: shadow ai, ai agent governance, ai agent accountability - Publisher: The Seattle Compute Company (Smith, https://www.smith.seattlecompute.com/) > Shadow AI agents are agents acting under a person's login with nobody tracking them. Then logs can't separate the person from the agent, so no one is accountable. Most agent horror stories start the same way. Someone wants a job done, finds a way to let an agent do it, and gives the agent what it needs to work: their password, their API key, their session. It works. Nobody writes it down. That's a shadow AI agent. This article is about why it's a problem, what the surveys say, and what a safer setup looks like. ## What a shadow AI agent is "Shadow IT" means tools people use without the company knowing. "Shadow AI" is the same idea for AI. A shadow AI agent is one step further: an agent that takes actions, running under someone's login, that the organization doesn't track as an agent. The key detail is the login. If an agent uses an employee's own account, then in every system it touches, the agent and the employee are the same user. Nothing in the log tells them apart. ## What the surveys found Two surveys in the last two years put numbers on this. Both are surveys of security and IT professionals, so these are what respondents reported, not measurements of every company. **SailPoint and Dimensional Research (May 2025).** SailPoint's report, based on a survey of 353 IT professionals with security responsibilities, found that [80% of companies said their AI agents had taken unintended actions](https://www.sailpoint.com/press-releases/sailpoint-ai-agent-adoption-report). Among respondents, 39% reported agents had accessed systems or resources they weren't supposed to, and 23% reported agents had been tricked into revealing access credentials. **Cloud Security Alliance (March 2026).** The CSA's report, [Identity and Access Gaps in the Age of Autonomous AI](https://cloudsecurityalliance.org/artifacts/identity-and-access-gaps-in-the-age-of-autonomous-ai), surveyed 228 IT and security professionals in January 2026. Its [press release](https://cloudsecurityalliance.org/press-releases/2026/03/24/more-than-two-thirds-of-organizations-cannot-clearly-distinguish-ai-agent-from-human-actions) says 31% allow agents to operate under human user identities, and 68% can't clearly distinguish between human and AI agent activity. The CSA's survey was sponsored by Aembit, which helped develop the questionnaire. We read the SailPoint press release and the CSA press release and report page. We have not checked the full reports' question wording. Put those side by side and you get the pattern. Many agents act under human identities. Many organizations can't tell the agent from the person. And a large share have seen agents do things nobody intended. ## Why it keeps happening It isn't carelessness. Using the person's login is the path of least resistance: - It works immediately. No new account, no approval, no ticket. - Most tools don't have a concept of an agent user. They have people. - The person doing it is usually trying to get real work done. The cost shows up later, in three places. **Accountability.** When an action goes wrong, the log shows the person. Proving they didn't do it is hard. Proving what the agent did is harder. **Access.** An agent running as you inherits everything you can reach, not just what the job needs. **Credentials.** If the agent holds your password, anything that can talk the agent into revealing it can get your access. That's the "tricked into revealing credentials" figure in the SailPoint survey. ## Governing agents You can't solve this by banning agents. People will keep using them. The fix is to make the safe path as easy as the shadow one. A workable setup has four parts. **1. Distinct identity or marked delegation.** Either the agent has its own account, or it uses a person's account in a way the log can tell apart. Smith supports both. With agent-owned identity, the agent has its own account and you can revoke it without touching yours. With delegated identity, the agent uses your account, but your password stays in an encrypted vault and the vault fills in the sign-in, so the agent never sees it. See [delegated vs agent-owned identity](/blog/delegated-vs-agent-owned-identity-for-ai-agents). **2. Scope.** Give the agent what the job needs and no more, with access you can revoke. **3. A record.** Every action traced to the agent that took it and the account it used. That is the thing that turns "68% can't tell" into "I can tell." **4. A way to stop it.** You should be able to stop an agent at any time and take over its screen when a step needs a person. [Keeping AI agents safe](/blog/keeping-ai-agents-safe-sandboxes-credentials-audit) goes through the sandboxes, scoped credentials and audit trail in more detail. ## A short checklist - Which agents are running in your company right now? Can you list them? - Whose login is each one using? - Could you tell, from a log, what an agent did versus what its owner did? - If an agent were tricked into leaking a credential, what would that credential open? - Who can switch it off? If you can't answer those, you probably have shadow agents. The answer isn't to stop using them. It's to give them an identity you can see. If you're hiring an agent for the first time, [AI agents for small teams](/ai-agents-for-small-teams) shows how Smith sets that up. ## FAQ **What is shadow AI?** AI use that the organization hasn't approved or can't see. Shadow AI agents are the sharper version: agents that act, not just answer, often under someone's existing login. **Why is an agent using my login a problem?** Because everything it does looks like you. If it does something wrong, or something you wouldn't have, the log says you did it. **How do you govern AI agents?** Give each agent a distinct identity or a clearly marked delegation, scope what it can reach, record every action against the agent that took it, and keep a way to stop it. --- Site index for LLMs: https://www.smith.seattlecompute.com/llms.txt