Shadow IT hardware, software and services used by enterprise staff without IT's approval can destabilize organizational operations. Unsecured technology can expose businesses and government entities to threats, usually without end users realizing how damaging shadow IT can be. Shadow AI is no exception.
Most shadow AI proliferation happens through browser-based agents. The web browser plays a central role at work as a highly accessible tool for internet interactions. End users can access AI chatbots, web assistants and browser extensions without involving IT procurement or authorizations that impede activity.
The downside of adopting browser-based agentic AI is that it opens the door to the latest shadow IT threat vector. Without intervention, these agentic AI tools creep into the enterprise, scraping data, communicating with APIs and automating workflows.
The problem is significant. One-third of employees admit to using unauthorized browser-based agentic AI tools, according to a 2026 Microsoft Cyber Pulse report. This figure represents only the employees who are aware they are using shadow agentic AI tools. It's likely the actual percentage is much higher.
Threats lurking in browser blind spots
Browser-based shadow AI agents can move autonomously with extensive enterprise access, circumventing normal IT visibility and controls without the oversight of traditional corporate governance.
Unlike conventional shadow IT, where an employee must intentionally accept an unapproved app, the employee can simply make a query or initiate a task in the browser, and the unsanctioned agent connects data pipelines, scrapes interfaces and accumulates data. These browser-based agents pass through encrypted web sessions, dodging normal data loss prevention (DLP) controls, email gateways and cloud access security brokers.
Shadow AI can evade UI controls and transmit source code, records and financial files to public or unmanaged large language models. These unsanctioned agents often use browser extensions or Model Context Protocol (MCP) servers, software programs that connect AI models, such as ChatGPT, to external data sources. This enables shadow AI to read local files and initiate API calls without IT approval.
Unsanctioned AI poses far-ranging risks to the enterprise, starting with credential exposure. Shadow AI agents can cache API keys, hardcoded secrets and shared tokens, hiding them from standard identity and access management controls.
These agents sometimes have broad permissions that enable them to read support tickets, approve workflows or initiate API calls. This can quickly lead to irreversible changes. Threat actors can mask malicious commands in hidden fields, guiding the shadow AI agent to capture sensitive data.
Employees might also paste sensitive information, such as intellectual property, financial data or customer records, into unapproved tools. This can violate regulatory requirements and put the data at risk of theft or misuse.
Building a layered control strategy and governance framework
To safeguard organizational data from shadow AI agents, enterprise security practitioners need multifaceted protections that go beyond rudimentary controls, such as URL blocking.
As with other aspects of security, IT organizations should address unsanctioned AI agent security at multiple levels, starting with an accurate inventory of IT assets and visibility into ongoing activity through browser telemetry and identity logs. Organizations need real-time, dynamic visibility into all software, including browser extensions, MCP connections and agent sessions.
IT should classify risk, map policies and label AI agents and browser extensions according to potential threat level and access scope. Policies must meet industry standards, such as the NIST AI Risk Management Framework.
Organizations must have identity and non-human access controls in place that treat AI browser agents and extensions as discrete digital identities that require session-based credentials. Security practitioners must have least-privilege access policies in place that specify which data unsanctioned agents can access and which tasks they can initiate. IT should also use microsegmentation to isolate agent executions to limit access privileges an at-risk browser has.
Security teams must be able to run adaptive interference to put hurdles in the way of potentially compromised browsers. They should also apply contextual DLP to ensure that any acquired data isn't distributed.
IT organizations must conduct frequent audits, log activity and perform forensic reconstruction after an incident. Every agent action, call and data transmission should be part of an immutable log, with appropriate human intervention when triggered by a risky action. Security practitioners should create reporting metrics aligned with business goals, such as avoiding regulatory fines and reducing attack surfaces.
As with any aspect of security, employee communication and collaboration are essential to effective protection. Security practitioners should assess how and why staff are using shadow AI and educate them on the potential dangers that technology can introduce to the enterprise.
Key tools to rein in shadow AI agents
Shadow AI agent detection is an essential component of an effective defense. Different types of tools can sniff out unsanctioned agents, including the following:
- Browser-layer security extensions. These run inside the browser environment and track employee views and interactions with authorized and unauthorized entities. They also assess client behavior and flag suspicious activity.
- Network-layer and API governance gateways. These platforms track network traffic, capturing and auditing data tokens as they move between browsers and external AI models. They call out potential risks, such as calls to unapproved domains or actions that deviate from normal human activity.
- Cloud discovery and enterprise application governance systems. These tools are part of more extensive suites, such as Microsoft Defender, and skim OAuth application registrations and API connection logs to score risk levels according to policies.
- Bot and agent trust management platforms. These defend websites from external AI agents that might attempt to infiltrate the site to initiate unauthorized tasks. These web application firewalls and bot detectors rely on machine learning to discern dangerous activity from harmless anomalies.
Amy Larsen DeCarlo has covered the IT industry for more than 30 years, as a journalist, editor and analyst. As a principal analyst at GlobalData, she covers managed security and cloud services.
