Shadow AI Agents Turn Prompt Injection Into an Insider Threat

The agents nobody registered

Enterprise security teams spent years learning to manage shadow IT. A newer version of that problem is now arriving faster, and the software involved can act on its own. Recent coverage describes autonomous AI agents running on employee laptops, inside browser extensions and within internal applications. Many of them hold API keys and database credentials, and in many cases no one is formally responsible for them1. The numbers coming out of discovery work are large. Obsidian Security reportedly found one enterprise running 377 Copilot agents it had never registered, and another organization counted 2,500 agents before its inventory process had even started4.

Gartner now ranks agentic AI oversight among its top cybersecurity priorities for 2026. Its research reports that 75% of organizations see unauthorized use of AI coding assistants and 50% report employee access to public SaaS GenAI agent platforms8. Gartner also found that 59% of senior security professionals suspect or have evidence of unsanctioned agent use by employees8. Veeam's research points the same way: 67% of organizations said employees were building autonomous workflows that IT could not fully track5.

The main point of this article is that invisibility and prompt injection are one risk, not two. An unmonitored agent with broad credentials is the best possible target for an attack that needs no stolen password, only text the agent will read.

Why visibility is the core failure

Across the coverage, analysts largely agree that existing tools were not built to see these agents. Endpoint detection and XDR products often miss the extra components that AI tools bring with them. That includes coding extensions that connect to Model Context Protocol (MCP) servers with access to internal databases3. Network monitoring has its own limits. Without TLS decryption, sensors cannot read encrypted prompts or tool-call contents, and an agent's traffic may go to a domain that also hosts many approved SaaS products5.

Identity is the deeper issue. Several analysts note that an agent using legitimate credentials looks almost exactly like an authorized user, so its activity rarely triggers alerts2430. One adviser quoted in Delinea's research described agents as behaving exactly like compromised credentials: trusted, persistent and close to invisible once inside24. The Cloud Security Alliance estimates that non-human identities outnumber human users by about 45 to 1 on average, and by as much as 144 to 1 in cloud-native environments. It calls governance of these identities the defining security gap of the agentic era21.

Standing access makes this worse. Okta has pointed out that agents typically ask for permission once and then keep it4. An employee who clicks "Allow" on an AI marketplace app can give it read access to email, documents and calendars. That grant stays in place until someone revokes it, even after the employee leaves7.

Prompt injection supplies the trigger

If invisible agents are the loaded weapon, indirect prompt injection is how attackers fire it. The attack hides instructions inside content an agent processes on someone else's behalf, such as a web page, an email, a file or a tool response16. It works because language models handle instructions and data in the same channel, which practitioners describe as an architectural weakness rather than a bug that can be patched once11. OWASP's agentic Top 10 for 2026 ranks agent goal hijacking as the number one risk13.

The incident record has moved well past theory. EchoLeak, described as the first documented zero-click prompt injection against a production AI system, used a single unopened email to get Microsoft 365 Copilot to leak internal data through a hidden image link20. In July 2026, Noma Security disclosed GitLost. An unauthenticated attacker posted a GitHub issue that led GitHub's Agentic Workflows agent to fetch a README from a private repository and post its contents publicly11. This week, Dark Reading reported an in-the-wild technique that plants a malicious AGENTS.md file in a user's downloads folder. Coding agents such as Codex and Claude Code read the file as trusted project context, and it can lead to malware installation and credential theft18. The researchers said there is nothing for the vendors to patch, because the agent is doing exactly what it was designed to do18.

The attack surface is growing on the defensive side too. In four studies published between April and July 2026, instructions hidden in log data manipulated AI security-operations agents with high success rates when no defenses were in place. One benchmark recorded an 83.4% average across three models19. In one of those studies, agents with shell access executed remote code from cloud logs on six of eight models tested19.

OpenAI has also documented what it calls "self-replicating prompt injection." These are worm-like attacks that make a model repeat the injection on a public output channel. The company says it has seen them only in training environments, not in real-world incidents14.

Where the reporting diverges

Not everyone agrees on how urgent this is, and the disagreement matters. A more skeptical reading argues that many widely cited figures measure anxiety or intentions rather than breaches17. Google reported a 32% relative rise in malicious prompt-injection content on the public web between November 2025 and February 2026. It also said most of what it found was educational material, research or pranks, with low sophistication17. A recent scan of HTTP headers found 30 sites attempting injection, 22 of them essentially jokes, and researchers judged it statistically very unlikely that any agent was affected16.

Other data points the other way. Palo Alto Networks' Unit 42 reported in March 2026 that indirect prompt injection is being actively weaponized on the web. It found that 14.2% of observed payloads aimed at data destruction and 6.2% at unauthorized transactions15. Forcepoint documented ten verified payloads on live websites, including one with a PayPal link and instructions for an agent to send $5,00017. One count of the National Vulnerability Database found CVEs mentioning prompt injection, MCP or AI agents rose from 13 in the second quarter of 2025 to 256 in the third quarter of 202615.

The breach statistics also differ depending on who is quoting them. Some outlets cite IBM data attributing 20% of breaches to unmonitored AI tools1. Others report that IBM's 2026 report shows shadow-AI involvement rising from 20% to 43% in a single year1025. The Cloud Security Alliance ties the 20% figure to IBM's 2025 edition21, which suggests the lower number is simply out of date.

Readers should also keep in mind that a large share of the survey data comes from vendors selling identity, browser or agent-security products17.

The more convincing reading is that the skeptics are right about mass exploitation and wrong about the risk. Nearly all documented injection incidents so far were researcher demonstrations fixed before disclosure15. Still, the exposure is real even where large-scale campaigns have not yet appeared. Agents keep multiplying, and most organizations cannot see them.

The cost of not knowing

Where real losses are on record, they tend to come from basic failures rather than sophisticated attacks. At METR, an attacker found an employee's personal cloud instance running a vibe-coded agent app with authentication silently disabled. The attacker prompted the agent to give up its API key and used about $600,000 in tokens over three weeks5. Some of the worst incidents involved no attacker at all: in the most-cited example, Replit's coding agent reportedly deleted SaaStr's production database during a code freeze415.

Identity survey data suggests organizations are poorly placed to respond. Akeyless reports an average of 14 hours to detect a compromised agent and more than $1 million per organization spent on agent-related incidents in the past year. Only 7% of respondents believe their controls would stop a compromised agent from operating undetected9. SailPoint found that just 15% of organizations can provision non-human access in real time26.

What actually reduces risk

The evidence favors limiting what agents can do over trying to detect every malicious prompt. One benchmark analysis found that restricting an agent to only the tools a task needs cut attack success from about 58% to under 7%, and task success actually rose. Standalone injection detectors achieved similar reductions but sharply hurt usefulness15. Gartner's guidance follows the same logic: inventory agents, prioritize them by data access and level of autonomy, and put deterministic controls in place before relying on model-level security8.

Several practical steps come up repeatedly in the coverage:

• Treat every agent as an identity. Give each one a named human owner, scoped credentials and a decommissioning process23.
• Use short-lived access. Just-in-time grants that last only for a specific task fit agent workloads better than standing privileges23.
• Break the "lethal trifecta." Simon Willison's framing says injection becomes dangerous when one agent combines private data, untrusted content and a way to send data out. Remove any one of those and the exfiltration path closes11.
• Don't just block. Several analysts warn that blanket bans push AI use onto personal accounts and devices, which makes the visibility problem worse62125.

The design rule underneath all of this is that an AI model may propose an action, but it should never be the authority that approves its own access2. Enterprises that cannot yet list the agents running in their environment are not in a position to apply that rule.