Shadow AI Identities: Nearly a Third of Firms Report Agent Misuse

The numbers behind the shadow agent problem

Shadow IT used to mean an unapproved SaaS subscription or a personal Dropbox account. In 2026 it increasingly means something with its own credentials, its own permissions, and the ability to act without a human in the loop.

AvePoint's State of AI 2026 research puts a figure on it. Unauthorized or shadow AI identities, meaning agents created or misused outside sanctioned processes, were reported by 30.1% of organizations 3. That is not quite the same as saying 30% of breaches involve such identities. The figure measures the share of organizations that experienced this category of AI agent incident. Even with that distinction, the number is striking.

It also does not stand alone. Among the AI agent security incidents organizations reported, the most common was sensitive data improperly exposed or retained by agents, at 50.1% 3. Agents being manipulated by malicious or untrusted inputs came close behind at 49.6% 3. That category covers prompt injection, poisoned documents and emails, unverified external data, and RAG leakage. A further 34.1% said autonomous agents had performed unauthorized actions such as modifying data, executing transactions, or changing systems without approval 3. Supply chain compromise affecting agent behavior (21.9%) and outright loss of control over agents or workflows (20.1%) round out the list 3.

The visibility gap may be the most telling statistic. 21.1% of organizations do not know whether unsanctioned tools are being used to build agents at all 3. Meanwhile, both sanctioned and unsanctioned access to agent-creation tools grew year over year 3.

What exploitation actually looks like

Survey percentages can feel abstract. Recent incidents show how these risk categories turn into real compromises.

In September 2026, Salt Labs researchers disclosed a critical flaw in Manus, an agentic AI platform valued at around $4 billion 2. Attackers could plant instructions in an email. The agent would then process those instructions, an indirect prompt injection. Using JSFuck obfuscation to slip past security filters, the researchers achieved remote code execution 2. They then demonstrated reverse shells and extracted credentials for services connected to the agent, including Gmail, Dropbox, and GitHub 2. The bug was reported through Meta's bug bounty program during an attempted acquisition and has since been patched 2.

The case maps neatly onto the survey's top categories. It began with an untrusted input and ended with data exposure. The real prize was the set of delegated credentials the agent held on a user's behalf.

GitLab's AI Gateway offers a different angle. On October 2, 2026, GitLab shipped versions 19.2.4, 19.3.2, and 19.4.1 to fix CVE-2026-90970, rated CVSS 9.9 1. The flaw let an authenticated user with Duo Agent Platform access submit a crafted agent flow that escaped the prompt-template sandbox and ran commands 1. User-authored flow definitions were rendered by a server-side template engine on the same machine that held model provider credentials, and the sandbox failed to neutralize that input 1. The same component class had already produced a 9.9-rated flaw earlier in the year 1. GitLab said hosted instances were already patched and no exploitation was reported 1. The same incident timeline also logs an AWS agent orchestration platform, Loom, that reportedly granted full admin rights too broadly 1.

Why legacy controls struggle

Living Security argues that AI agents introduce attack vectors that traditional security tooling simply cannot see, citing prompt injection and cascading failures in particular 4. The incidents above support that view. In Manus, the malicious payload arrived as an ordinary email. At GitLab, it arrived as a legitimate feature, a user-defined workflow. Neither looks like classic malware at the perimeter.

The common thread is identity and privilege. Agents are often given standing access to email, code repositories, cloud storage, and model API keys so they can be useful. Once an agent is steered by hostile input or a sandbox escape, an attacker inherits that access. When the agent was spun up outside IT's view, nobody is watching what it does with it.

The takeaway

The framing of shadow AI as merely a new flavor of shadow IT undersells the problem. An unsanctioned spreadsheet tool leaks data passively. An unsanctioned agent can take actions, chain into other systems, and carry credentials that outlive the employee who created it.

For security teams, the practical reading is to treat agents as identities first. That means inventorying them and scoping their permissions tightly. It also means assuming any content they ingest, including emails, documents, and templates, may be adversarial. The roughly one in five organizations that cannot say whether shadow agents exist are, by that measure, already behind.