InformationWeek on October 16 is the escalation note. Shadow AI is no longer someone pasting a contract into ChatGPT. People are building agents that take actions. Microsoft’s 2025 survey of 1,725 data security leaders, in that piece, puts unsanctioned agents at work at nearly three in ten employees. Adobe, surveying more than 1,000 people who use AI weekly, found that nearly half of the employees who get agentic training go on to build their own custom agents. That is not a chatbot policy. That is a build pipeline you do not own.
SumatoSoft the same day is the production study with a smaller room. Forty practitioners described one live deployment. 25.6 percent of those deployments run unattended. 80 percent narrowed the workflow after go-live. Median share of agent code merged without review: 0 percent. The headline “1 in 4” is that sample, not Gartner’s 17 percent, not Sinch’s 62 percent in customer communications. The spread is the point. Definitions moved. Your dashboard did not.
We already filed shadow AI as a tool-management problem and a CIO list of where agents are allowed. This week the unsanctioned object has hands.
Three in ten is not a Copilot license
InformationWeek’s Microsoft number is a survey of security leaders, not a census of laptops. Treat it that way. Nearly three in ten employees using unsanctioned agents is still a different failure than three in ten using an unsanctioned chatbot. An agent that can call a tool can move a file, open a ticket, or send a message. The page says the data-leak story is only part of it. The other risk is institutional knowledge walking out of the official system and into a personal agent someone built after a training lunch.
Adobe’s “nearly half” sits next to that. Training, in that survey, is not a control. It is how people learn to ship the unofficial thing. If your enablement slide deck includes “build your own agent,” and your inventory does not, you paid for the shadow.
Deloitte, 3,235 IT and business leaders, only 21 percent reporting mature governance for agentic AI risk. Cloud Security Alliance, this year: more than half of surveyed organizations have already seen agents exceed intended permissions. You can argue with any one of those instruments. You cannot argue with the direction. Permission models built for humans are the ones agents are walking past.
We already wrote rogue agents as a guardrail meeting. This week’s add is the unofficial build. A sanctioned Copilot in Outlook is a product you can turn off. A custom agent on a laptop is a product you find in an incident.
Forty deployments is a small study. Unattended is not a vibe
SumatoSoft asked people to put one named workflow on a shared five-level scale and say what the agent does without a person in the loop. That is why 25.6 percent is usable even with n=40. It is not “AI in production” as a slogan. It is “this workflow runs without a watcher” as a label the respondent had to own.
0 percent median code merged without review is the other number people will skip. The agents that made it into this sample still went through a human merge. That is not a safety proof. It is a description of how these forty got to production. If your shop merges agent changes the way it merges intern scripts, you are not in this sample. You are the control group nobody surveyed.
80 percent narrowed the workflow after go-live. Sinch, cited in the same write-up, surveyed 2,527 senior decision-makers across ten countries in early 2026 and found 74 percent had rolled back or shut down a live customer-communications agent. At the firms with the most mature guardrails the share was 81 percent. SumatoSoft notes the direction: tighter shops kill more agents, or at least admit to killing them. A rollback is not a scandal if you count it. It is a scandal if your status page still says “deployed.”
Published production rates in that piece run from 11 percent (Deloitte’s 2025 Emerging Technology Trends, as reported in Tech Trends 2026) to 62 percent (Sinch, customer communications) with Gartner’s 2026 CIO survey at 17 percent deployed. Do not average them. They are not the same quantity. Pick the definition your board uses and stick to it for a quarter.
Asurion’s 55 percent is a bottleneck, not an estate
InfotechLead on October 14 is the vendor-case roundup. Asurion’s October 2026 write-up, as cited there, put a Copilot Studio agent on invoice exceptions before the record hit finance. Touchless processing above 55 percent in the first week for North and South American vendors, later above 70 percent. The earlier below-20-percent baseline was two vendors. The populations are not identical. 85 percent-plus is still a target, not a result.
That is a useful production story because it is small. One bottleneck. One existing capture workflow. Expand after the number moves. It is not a counter to InformationWeek. A sanctioned invoice agent in Copilot Studio is the opposite of three-in-ten unsanctioned builders. You can have both in the same company. The invoice agent is in a system of record. The unofficial agent is in a browser profile.
The same InfotechLead piece cites a survey in which 77 percent said AI adoption was outpacing governance and 85 percent lacked full visibility into real-time AI spending. A June 2026 study, in that write-up, associated embedding controls in the AI systems themselves with 25 percent fewer incidents. Survey association. Not a guarantee. Still a better sentence than “we have a policy PDF.”
GE Appliances’ April figure of more than 800 agents and 25 percent fewer backorders is older than this week’s window. Leave it as context if you must. Do not treat it as October news. The live comparison is Asurion’s invoice exception versus Microsoft’s unsanctioned-agent share. One is a named workflow. The other is a workforce behavior.
Inventory is the control that is not a model
If three in ten people can stand up an agent, your CMDB is the product. Name the endpoint. Name the tools it can call. Name the identity it uses. Name whether it runs unattended. SumatoSoft’s five-level scale is stealable even if you never send them data. Put every “agent” on that scale before you let a vendor put it on a slide.
Permission exceedance, in the Cloud Security Alliance figure, is the failure mode that policies about “don’t paste PII” do not cover. An agent that was allowed to read a folder and then wrote to a different one did not need a leaked prompt. It needed a scope. If more than half of surveyed orgs have already seen that, your first table is not model evals. It is OAuth grants.
Institutional knowledge, in the InformationWeek closer, is the slow leak. People build a personal agent that “knows how we do refunds” because the official wiki is stale. The agent works. The wiki dies. Then the person leaves. You cannot incident-response your way into a wiki that nobody updated because the unofficial agent was faster. That is a documentation problem with an API.
What to put in the ticket this week
Do not write “govern agents.” Write three fields. Is this agent sanctioned. Does it run unattended. What is the rollback that looks like Sinch’s 74 percent without a press cycle. If you cannot answer the second field, you are not in production. You are in a demo that someone left on.
Pair the Microsoft 3-in-10 with the Adobe training number before you fund another enablement day. If training produces unofficial builders, the next session needs an inventory form, not a sticker. Pair SumatoSoft’s 0 percent unreviewed merges with your actual pull-request policy for anything that can call a tool. If intern code needs review and agent code does not, you already picked a number. It is not 0 percent.
The CIO.com “five things” post dated October 15 is a CrowdStrike BrandPost. Skip it as a fact source. You do not need a vendor listicle to know that an endpoint agent with the user’s permissions is a different object than a chatbot in a browser. InformationWeek already said that in English.
A case study that moves invoice exceptions from a two-vendor baseline to 70 percent touchless is a real workflow. An unsanctioned agent on a laptop is also a real workflow. Only one of them will show up in your spend dashboard. The 85 percent who cannot see AI spend in real time, in the InfotechLead survey line, are how the other one stays invisible.
Unattended is a checkbox, not a maturity story
SumatoSoft’s 25.6 percent unattended is the number that should change a runbook. Unattended means the agent keeps going when the person who demoed it is in a meeting. That is useful in invoice exceptions if the exception policy is written down. It is how you get the Cloud Security Alliance failure if the policy is “it usually asks.” Put the checkbox on the intake form. If the vendor cannot say whether the thing runs without a human, you do not have a vendor answer. You have a demo.
The 80 percent who narrowed after go-live are the other runbook line. Scope shrinks. That is not failure. That is how you avoid the CSA “exceeded permissions” bin. Write the first production scope as smaller than the slide. Then log the shrink. If you cannot show a shrink, you are either lucky or you never looked.
Sinch’s 74 percent rollback, 81 percent in the most guarded shops, is the number to take to a steering committee that thinks a kill switch is a lack of ambition. The shops with guardrails killed more agents, or admitted it. Count your kills. If the count is zero and the Microsoft 3-in-10 still applies to your workforce, the kills are happening on laptops you do not own.
Regal Rexnord’s “2,400 hours” line in the InfotechLead roundup is a knowledge-agent claim. Leave the hour count in the vendor pile until you see the instrument. The steal is the category: an employee knowledge agent is how unofficial how-to leaks into a sanctioned box, which is the opposite of InformationWeek’s knowledge-walks-out risk. Same shape, different owner. Pick an owner.
Put the unofficial agent on the same list as the invoice bot. If you will not, the 21 percent with “mature governance” will not include you, and you will not be surprised. The model is not the estate. The estate is whatever can act when nobody is watching.