Shadow AI Agents: Surveys Find About 3 in 10 Are Unsanctioned — How IT Teams Can Respond
Surveys put unsanctioned AI agent use near 3 in 10 employees. What the data from Microsoft, Adobe, Deloitte, and a 40-deployment production study show, and practical steps IT teams can take to inventory and govern agents.
Shadow AI used to mean employees pasting documents into an unapproved chatbot. In 2026 it increasingly means employees building their own AI agents: tools that can call other software, move files, open tickets, and send messages. Several surveys now put the share of employees using unsanctioned agents at roughly three in ten, while the governance needed to track those agents lags behind.
This article summarizes the survey evidence, explains why agents raise different risks from chatbots, contrasts unsanctioned agents with a well-scoped production deployment, and sets out practical steps for IT teams.
The survey evidence
InformationWeek’s October 16 analysis brings together several data points:
| Source | Sample | Finding |
|---|---|---|
| Microsoft (2025) | 1,725 data security leaders | Nearly 3 in 10 employees use unsanctioned agents at work |
| Adobe | 1,000+ weekly AI users | Nearly half of employees who receive agentic training go on to build custom agents |
| Deloitte | 3,235 IT and business leaders | Only 21% report mature governance for agentic AI risk |
| Cloud Security Alliance | Surveyed organizations | More than half have seen agents exceed intended permissions |
Each survey measures something slightly different, and the Microsoft figure comes from security leaders’ estimates rather than a count of devices. The direction, however, is consistent: agent building is spreading faster than oversight, and permission models designed for human users are not holding up well when agents act on users’ behalf.
The Adobe finding is particularly relevant for training programs. If teaching employees about agents leads nearly half of them to build their own, enablement sessions should come with a way to register and review what gets built.
Why agents are a different risk from chatbots
A chatbot mostly creates data-exposure risk: sensitive information typed into a service the company does not control. An agent adds the ability to act. It can call tools, change records, and communicate with others using the employee’s access. InformationWeek also highlights a slower risk: institutional knowledge moving out of official systems. An employee who builds a personal agent that “knows how we handle refunds” may stop updating the official documentation, and when that employee leaves, the knowledge leaves with the agent.
The Cloud Security Alliance finding (more than half of organizations seeing agents exceed intended permissions) shows that the main problem is often scope rather than a malicious prompt. An agent allowed to read one folder that ends up writing to another needs better permission boundaries, not just a usage policy.
What production deployments actually look like
SumatoSoft’s production study, also published October 16, offers a smaller but more detailed view. Forty practitioners each described one live agent deployment and rated it on a shared five-level scale of autonomy:
- 25.6% of the deployments run unattended, without a person in the loop.
- 80% narrowed the agent’s workflow after go-live.
- The median share of agent code merged without human review was 0%.
The sample is small, but the shared scale makes the results more meaningful than a loose question about “AI in production.” The findings suggest that agents that reach production in these organizations are usually reviewed and often scaled back once real-world behavior is visible.
The same write-up cites other research showing how widely estimates vary. Sinch surveyed 2,527 senior decision-makers in ten countries in early 2026 and found that 74% had rolled back or shut down a live customer-communications agent, rising to 81% at firms with the most mature guardrails. Published production rates range from 11% (Deloitte) to 17% (Gartner’s 2026 CIO survey) to 62% (Sinch, for customer communications). These figures use different definitions and should not be averaged; organizations should pick one definition and track it consistently.
The Sinch result is worth emphasizing for leadership teams: organizations with stronger guardrails shut down more agents, or at least reported doing so. Rollbacks are a sign that oversight is working, not a failure.
A contrasting example: a sanctioned, narrow agent
InfotechLead’s October 14 roundup of enterprise deployments includes Asurion, which used a Copilot Studio agent to handle invoice exceptions before records reached finance. Touchless processing rose above 55% in the first week for North and South American vendors and later above 70%, compared with an earlier baseline below 20% for two vendors (the populations were not identical). The company’s 85%-plus figure is a target, not a result.
This example is the opposite of shadow AI: one defined bottleneck, inside an existing system of record, expanded only after results improved. The same company can have both kinds of agents. The difference is that the sanctioned one is visible to IT and finance, while the unofficial one may exist only in a browser profile.
InfotechLead also cites survey findings that 77% of respondents said AI adoption was outpacing governance and 85% lacked full visibility into real-time AI spending, along with a June 2026 study associating controls built into AI systems with 25% fewer incidents. These are survey associations, not guarantees, but they support building controls into tools rather than relying on policy documents alone.
Practical steps for IT teams
1. Build an agent inventory. For every agent, record:
- Whether it is sanctioned
- Which tools and systems it can call
- Which identity and permissions it uses
- Whether it runs unattended
- Who owns it and how it can be shut down
SumatoSoft’s five-level autonomy scale is a useful template for the “unattended” question.
2. Review OAuth grants and permissions. Given the Cloud Security Alliance finding, auditing what agents can access is a higher priority than evaluating models.
3. Pair training with registration. If training produces new agent builders, include a simple registration form in the session.
4. Require code review for agent changes. In SumatoSoft’s sample, agent code was reviewed before merging. Apply at least the same standard used for any script that can change production data.
5. Start narrow and record changes. Define a smaller initial scope than the vendor demo suggests, and log when scope is narrowed. That record is evidence of active oversight.
6. Plan rollbacks. Define how an agent will be shut down before it goes live, and count rollbacks as a normal governance metric.
7. Keep documentation in official systems. Encourage employees to put the knowledge behind their personal agents into shared documentation or a sanctioned knowledge agent, so it does not leave with them.
A note on sources
Some coverage of this topic is vendor-sponsored content. For factual claims, we rely on the independent reporting and research summaries cited here, and we treat vendor case-study figures, such as hours saved, as claims until the measurement method is published.
Related coverage
For earlier analysis, see why most workers use AI tools outside IT’s view, managing employees’ parallel AI tools, CIO guardrails for rogue agents, and where enterprises are allowing agents to operate. For the workforce side, see our coverage of Gartner’s finding that only 4% of CIOs have redesigned roles for agents.
Bottom line
Roughly three in ten employees may already be using agents their employer has not approved, and those agents can act, not just answer. The most effective response is not a stricter policy document but visibility: an inventory of agents, their permissions, and whether they run unattended, combined with narrow initial scopes, code review, and planned rollbacks. Sanctioned, well-scoped deployments like Asurion’s invoice agent show what controlled adoption looks like.
Sources
- InformationWeek, “Shadow AI has gone agentic: are organizations ready?” (October 16): https://www.informationweek.com/machine-learning-ai/shadow-ai-has-gone-agentic-are-organizations-ready-
- SumatoSoft, “AI agents in production” (October 16): https://sumatosoft.com/research/ai-agents-in-production
- InfotechLead, “Enterprise AI deployment in 2026: eight companies turning pilots into business results” (October 14): https://infotechlead.com/artificial-intelligence/enterprise-ai-deployment-in-2026-eight-companies-turning-pilots-into-business-results-98871