{"slug": "shadow-agents-make-the-old-shadow-it-problem-worse", "title": "Shadow agents make the old shadow IT problem worse", "summary": "A new report warns that 'shadow agents'—unauthorized AI agents deployed by employees without IT approval—are exacerbating the old shadow IT problem, as these agents can autonomously access and act on data with little oversight. The report, citing examples like a marketing executive using a Marketo agent, notes that most companies lack a robust inventory of agents on their networks, and proposes using DNS-based verification, similar to DMARC for email, to authenticate agents before granting access.", "body_md": "Companies are running into a new version of an old problem. Take, for example, a marketing executive turns on an agent from Marketo but doesn’t tell their IT team. That shadow agent now has access to customer data with little oversight and no clear adherence to the company’s security or compliance policies.\n\nThat’s a real scenario that’s happening now. It’s also the same pattern that made shadow IT a headache for over two decades. Employees often adopted unapproved tools that helped them do their job faster and better because the company option just wasn’t as good.\n\nWith agentic AI, it’s different because of what an unauthorized agent can do. Shadow IT tools mostly accessed or handled data without proper authorization. Agents, on the other hand, can take it much further by acting on that data by pulling records, sending messages and making changes with little oversight. Forcing agent data interactions via [model context protocol](https://modelcontextprotocol.io/docs/2026-07-28/getting-started/intro) can help, but the fact is there’s an autonomous agent that IT has little to no visibility into.\n\nNow multiply that one marketer by every department, plus every agent that your vendors in HR, finance and elsewhere run in your systems. It’s a situation that most companies have no way to see, let alone control. This can become hundreds of vendors each running multiple agents, moving between your company, their company and your supply chain. That’s many thousands of agents with no consistent way to track what they are doing.\n\nI often ask security teams: Do you have a robust inventory of the agents operating on your network? For most companies, the answer is no. And even if a company scanned its network, it’s not clear that agents are what they claim to be. So, there can be an unknown number of agents from unverified provenance performing a multitude of tasks and data exchanges on your network. This unfortunately is the current state of affairs at most companies.\n\nShadow IT used to be technology that was used for work without explicit IT approval. Ten years ago, that meant a personal Dropbox folder or an unsanctioned project board. Today, it can mean an agent with a login and a task list, who is working inside your systems. That’s what shadow agents are.\n\nWhen an agent gets access, it can quickly pull a record, draft a reply, update a field, move a file — the list goes on. This can happen before anyone even notices anything happening.\n\nSecurity teams often say you can’t protect what you can’t see. That was true when the invisible thing was a spreadsheet. But it reaches another level when that agent has a login and knows what to do with it.\n\nHow do you know an email that looks like it’s from Uber is actually from Uber? I ran into this problem, years before AI was an issue.\n\nSay you get an email after an Uber ride saying, “Thanks for riding, click here for your receipt.” It says it’s from Uber. It’s actually sent by a vendor like SparkPost, on Uber’s behalf. Uber authorized it. The vendor is doing what Uber asked it to do. But nothing in the email told your inbox that there was permission, so your inbox just trusted the “from” line. Worse, it could’ve easily been a phishing attack from a criminal purporting to be Uber.\n\nTo address this, the email sender should have been authenticated against a trusted source before the email lands in your inbox.\n\nThat’s DMARC. A decade and over 1 million domains later, it’s proof the model works at scale. Verify the sender against a record that the domain owner controls and the guessing goes away.\n\nDNS is already the internet’s phone book and a secure, trusted and public-facing database representing the domain. An agent claiming to represent Salesforce or any vendor can be checked against Salesforce’s DNS-secured record before it’s ever granted access.\n\nThat one check answers a critical question: Is this agent who it says it is, and did the company it claims to represent actually authorize it?\n\nOnce an agent is verified via the domain owner’s DNS record, there’s a domain cryptographically attached to the agent, and accountability that didn’t exist before.\n\nRight now, most organizations don’t have that. An agent shows up and asks for access. But if something goes wrong, no one is really responsible, because nobody checked in the first place. They “trust” that the agent is what it claims to be. This gets even more complex if the agent is from a known hyperscaler/AI company but acting on behalf of an untrusted/unknown user (e.g., a ChatGPT agent but getting instructions from a criminal)\n\nMost of security has worked the same way for years: Try to identify everyone who shows up, then decide if they’re trustworthy. That’s backwards, and email proved it over a decade ago. A layered approach with zero trust upfront and further interrogation of what’s left over combines the efficiency and low cost of zero trust with deep inspection as a second pass, providing a highly effective level of security.\n\nWith agents, the logic is the same: Don’t evaluate whether an agent is trustworthy after it’s already inside your systems. Check whether it’s on the list before it gets anywhere near the door.\n\nThis means a legitimate agent might get turned away because someone forgot to add it to the list. But that inconvenience is much better than the alternative of letting everything in and just hoping things go well.\n\nThere are two separate questions inside every access decision. Most conversations about AI governance conflate them. First, who is this? Second, what are they be allowed to do?\n\nThis is like a passport and a visa. The passport says who you are. The visa says what you’re permitted to do and where you’re permitted to go. They’re issued by different authorities for different reasons. Confusing the two is where a lot of security approaches go wrong.\n\nUpfront agent authentication, also known as a passport, can tell you whether that agent claiming to be from Salesforce is really Salesforce’s. Next, you need to figure out if Salesforce is authorized to work in your system and what it’s allowed to do. Your approved list of vendors and the approved actions should be made on purpose rather than defaulting to whatever the agent claims about itself.\n\nThe identity layer has to get solved first and solved the same way for everyone. But the permission layer is where every company’s answer is different, based on what that specific agent actually needs to access. Complicating matters, agents can change their workload mid-process. So, the permissions need to be continuous and focus on ongoing workloads as they evolve. This is a growing, urgent problem.\n\nAI-generated phishing is now three times more effective than traditional campaigns, according to [Microsoft](https://protect.checkpoint.com/v2/r01/___https:/www.microsoft.com/en-us/security/security-insider/threat-landscape/microsoft-digital-defense-report-2025___.YXAzOmRpZ2ljZXJ0OmM6b2ZmaWNlMzY1X2VtYWlsc19hdHRhY2htZW50OjkxYjAwZGU0NDE3YzA5YTJlOWExYTA0ODFjMjM1NWI0Ojc6MmZmMTo5MDZiNGE2NTkzOTA5OTA1NmI2ODM5MDg0ODMxOWY1YTQzMWVjMWMwYWNmMmRkOTI1NDk2ODU4NjQ5YTFlM2JmOnA6RjpG).\n\nA year ago, AI-written phishing attempts were easy to spot due to bad grammar or strange tone. That has changed on an exponential curve, a progression humans’ brains have a hard time grasping. The same category of tool getting better at impersonation is now showing up as unauthorized agents inside company systems. And improving exponentially. Better deception plus more access adds up to a problem that grows faster than we can even imagine.\n\nShadow IT taught the industry a lesson. Now, shadow agents are teaching it again. You can’t secure what you don’t know is running inside your systems. For the marketer turning on the Marketo agent, what would have caught it isn’t a smarter firewall or a longer policy document; it’s a check, run before access is granted, confirming that the agent is who it claims to be and that someone actually authorized it. It’s followed up with continuous permissioning and logging to make sure the agent does what it’s supposed to.\n\nThat’s the shift: Verify an agent’s identity before it gets anywhere near the door. Email already proved this model at scale across roughly 1 million domains. Shadow agents are the same problem showing up again in a new form. It doesn’t need a new fix. It needs the one that already works.", "url": "https://wpnews.pro/news/shadow-agents-make-the-old-shadow-it-problem-worse", "canonical_source": "https://www.cio.com/article/4214992/shadow-agents-make-the-old-shadow-it-problem-worse.html", "published_at": "2026-08-28 10:00:00+00:00", "updated_at": "2026-08-28 10:20:03.137664+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-policy"], "entities": ["Marketo", "Uber", "SparkPost", "DMARC"], "alternates": {"html": "https://wpnews.pro/news/shadow-agents-make-the-old-shadow-it-problem-worse", "markdown": "https://wpnews.pro/news/shadow-agents-make-the-old-shadow-it-problem-worse.md", "text": "https://wpnews.pro/news/shadow-agents-make-the-old-shadow-it-problem-worse.txt", "jsonld": "https://wpnews.pro/news/shadow-agents-make-the-old-shadow-it-problem-worse.jsonld"}}