AI agents run amok: shadow apps, rogue bots, and the new frontlines of enterprise cyber risk

The rapid proliferation of autonomous AI agents within enterprises presents a profound security dilemma, as these agents often operate with system-level access inherited from the users who deploy them, creating significant risks of unauthorized actions. For instance, BeyondTrust’s Phantom Labs documented a staggering 466.7% year-over-year increase in AI agents, with some environments hosting up to 45 AI digital identities per human employee, many lacking proper oversight. This surge, coupled with engineers’ pressure to deploy powerful agents like OpenClaw despite known vulnerabilities, underscores the tension between operational demands and security governance, as Zico explains the ongoing challenge to balance agent power with robust security measures.

Traditional static privilege models fall short in securing autonomous AI agents due to their non-deterministic, goal-driven behaviors that continuously evolve at scale, necessitating dynamic, real-time privilege management tailored to each agent’s intent and context. Itamar Apelblat highlights that least privilege must shift from static lists to adaptive enforcement that validates every action against the agent’s purpose, preventing scenarios where an agent gains excessive rights—such as admin access to production environments—thereby mitigating risks like prompt injection attacks or unauthorized data deletion.

Enterprises face acute challenges in implementing fine-grained, centralized access controls for AI agents, as overly broad permissions often become the default due to management complexity, exposing systems to privilege escalation and unauthorized autonomous operations. Leveraging identity platforms like Okta or Entra enables scalable, auditable policies that restrict AI agents’ access to only what users are entitled to, with group-based policies facilitating governance at scale. However, as one security expert warns, agents lack the contextual understanding to discern when they should withhold access, making continuous monitoring and auditing indispensable to prevent agents from autonomously performing unintended or harmful actions.

The exposure of enterprise AI infrastructure—including gateways, inference endpoints, and development environments—has become a critical attack vector, with adversaries exploiting publicly accessible AI endpoints to run autonomous offensive agents without breaching networks first. Researchers observed attackers configuring AI agents to use exposed endpoints as model providers for covert reconnaissance and penetration testing, while vulnerabilities in components like LiteLLM are rapidly weaponized post-patch release. Consequently, organizations must treat AI infrastructure with the same security rigor as other internet-facing systems, enforcing strong authentication, network segmentation, continuous monitoring, and prohibiting unauthorized AI deployments to mitigate this emerging threat landscape.

Shadow AI has surged as employees increasingly turn to unauthorized AI applications like ChatGPT, Gemini, and Cursor to handle confidential company data, inadvertently embedding sensitive intellectual property into AI models and exposing organizations to significant data leakage risks. Studies reveal that nearly 40% of these AI tools are configured by default to train on user inputs, meaning proprietary information not only leaves corporate firewalls but becomes part of external AI systems’ knowledge bases, amplifying compliance and security concerns. As one expert observed, these unauthorized apps generate the very secrets companies strive to protect, creating a persistent and insidious threat vector.

The proliferation of shadow AI is staggering, with research from Prompt Security and Teramind detecting close to 20,000 distinct AI applications in use across enterprises, often sourced personally by employees rather than sanctioned by IT. This widespread, unmanaged adoption results in profound blind spots, as 67% of AI activity occurs through unmanaged personal accounts on corporate platforms like Microsoft 365, embedding AI features invisibly into everyday workflows. Teramind’s VP of Strategy, Leeron Walter, highlights this hidden layer, noting that AI is now baked into tools companies already pay for, complicating governance and increasing the risk of unnoticed data exposure.

Human factors exacerbate shadow AI risks, as 66% of workers knowingly use banned AI apps at work, with 43% admitting to inputting sensitive emails and correspondence into public AI tools despite company policies. This overconfidence—72% of employees believe they understand AI better than their managers—combined with dissatisfaction toward IT-approved AI solutions, drives employees to circumvent controls, often under time pressure or workplace distractions. Consequently, organizations face a chaotic AI landscape where 55% describe AI use as a 'free-for-all,' and many lack the ability to detect or shut down rogue AI agents, leaving security leaders to grapple with a growing, invisible threat.

Addressing shadow AI demands a cultural and governance shift rather than outright bans, as nearly half of employees would continue using AI tools even if prohibited, often hiding their usage and sharing proprietary data with unsanctioned platforms. Security leaders acknowledge the impact—52% report unsanctioned AI apps have hurt their security posture—yet 84% agree that improvements are needed to align AI use with organizational policies. Experts like Isaac Kohen and Leeron Walter advocate for making secure AI options as fast and frictionless as risky ones, emphasizing that the challenge is not a technology gap but a governance gap requiring telemetry, codified data-handling rules, and a security-first mindset to tame the shadow AI phenomenon.

By 2025, AI-enabled prompt injection attacks surged dramatically, with CrowdStrike reporting at least 90 targeted organizations, and nearly 40% of firms experiencing breaches that bypassed AI security guardrails, according to Fintech Singapore. This rapid escalation underscores the urgent need for CISOs to proactively tighten controls around AI coding tools and communicate these evolving risks clearly to business leadership, as emphasized by Mozilla’s Montez Fitzpatrick who urges security leaders to 'march right into your CIO' to ensure AI risks are taken seriously without stifling innovation.

AI-driven cyberattacks have evolved into stealthy, multi-step campaigns that operate at machine speed with adaptive decision-making, fundamentally transforming incident response strategies. Sysdig’s analysis of JADEPUFFER—the first fully autonomous AI-run ransomware attack—revealed how AI agents can exploit vulnerabilities, navigate networks, and execute complex operations in seconds, far outpacing human defenders. This shift demands that organizations move beyond traditional manual adversary assumptions to monitor for atypical API patterns and long-lived sessions indicative of automated orchestration, as highlighted by QBE’s Ian Walsh.

The rise of agentic AI lowers the technical barrier for cybercriminals by packaging reconnaissance, exploitation, and attack orchestration into accessible interfaces, enabling even less sophisticated actors to launch complex campaigns such as extortion, deepfake impersonation, and advanced phishing. Exabeam’s Findlay Whitelaw warns that AI agents, operating with legitimate credentials and autonomous authority, expand insider risk to non-human actors, complicating detection and necessitating enhanced behavioral analytics to distinguish malicious activity from routine operations.

Traditional single-message safety checks are insufficient against sophisticated prompt injection attacks that unfold over multiple interactions, exploiting AI’s inherent helpfulness by framing harmful requests as benign tasks like 'help me test this' or 'be creative.' Continuous monitoring and observability of safety controls are critical to detect silent failures, especially after model updates, enabling internal teams to proactively identify and remediate vulnerabilities before attackers exploit them, as stressed in recent analyses emphasizing safety as an ongoing discipline rather than a one-time launch state.