A firm’s agent count isn’t low, its instrument is: firm-level and worker-level surveys of the same population disagree by an order of magnitude, and every control the firm owns is sized off the firm-level number.

The mechanism

Two instruments measured US generative-AI adoption in the same window and disagreed by a factor of five. The Census Bureau’s Business Trends and Outlook Survey asked firms: 3.7% in December 2023, 5.4% by February 2024. Bick, Blandin and Deming asked workers, on a nationally representative CPS-modelled panel, and found in August 2024 that 39.4% of US adults 18–64 used generative AI and 28% of employed respondents used it at work (NBER WP 32966; Management Science, 2025). European government survey data reproduces the same sign of error on a different instrument (arXiv:2604.18849, on the 2024 European Working Conditions Survey; its 12% base rate cannot be compared with the US figures, only its direction); all of these are government or academic instruments rather than security-vendor surveys.

That gap is the concern. The number a governance program runs on was produced by asking people who cannot see the answer.

Three things get called the same name and need different responses. A shadow agent is unsanctioned from birth: an employee built it, nobody registered it, and no approval was refused because none was sought. OWASP’s T13 rogue agent is adversarial or compromised inside a system the firm did sanction (Agentic AI: Threats and Mitigations v1.1; the separate 2026 Top 10 covers it as ASI10, so a citation should say which document it means). T7 misaligned behaviour is drift with no attacker present. Microsoft’s own Copilot Studio guidance files shadow agents as an anti-pattern caused by teams moving faster than enterprise standards, correctly naming the cause as latency rather than malice.

A fourth case has neither a name nor an owner: the feature a vendor switched on inside software a firm already bought, which nobody built and nobody registered because it arrived in a release note. Booz Allen described it in December 2024 as third parties “embedding AI into products without notifying users,” and FINRA has since closed the question of whether it counts, telling member firms their obligations apply “including through embedded features in existing third-party products” (Regulatory Notice 24-09, 2024-06-27). That notice binds broker-dealers, not advisers, but it is the only place a regulator has addressed the case directly.

Everything shadow IT taught points the wrong way. The classic case was a marketing team expensing Trello: unsanctioned vendor, bounded blast radius, audit logs existing somewhere. The agent version inverts the topology, and CSA’s formulation is the one to keep: the platform is sanctioned; the application is not. Power Platform, ServiceNow and Salesforce are all approved. Whether the thing an analyst built on one last week was ever reviewed is a separate question, and the traffic looks legitimate to every network-layer control the firm owns. CASB, DNS filtering and egress monitoring find unsanctioned destinations, not an unsanctioned agent talking to a sanctioned one.

Per-instance configuration is why platform approval doesn’t transfer downward: instances of the same underlying system get different tools, prompts and memory, and behave differently as a result (Chan et al., “Visibility into AI Agents,” FAccT ‘24). Approving Copilot Studio leaves the forty agents built inside it unapproved. And agents make agents: SAGA (NDSS 2025) models a parent sharing its TLS keys and access tokens with a child it never registered, a population a people-focused amnesty program will never reach.

The artifacts are frequently already public, and the exposure threshold was a public URL rather than a vulnerability. Red Access scanned leading vibe-coding platforms and reported 380,000+ publicly reachable web assets, ~5,000 appearing corporate, and 2,000+ of those holding sensitive data with no access controls, often with default admin access to anyone holding the URL (Axios reported the same counts, 7 May 2026; methodology withheld, so the counts stand as vendor-claimed).

People hide this deliberately, for rational reasons. Mollick’s “secret cyborgs” (June 2023) gave them their canonical form: bans make disclosure punishable, work known to be AI-assisted is judged as worth less, and anyone who has automated most of their job has an obvious reason to keep quiet. Survey evidence corroborates the first from the other side: 63% consider unapproved use acceptable when the firm offers no sanctioned option, 58% of unapproved users are on free consumer tiers, and 51% say they have connected AI tools to work systems without IT approval (Sapio Research for BlackFog, n=2,000 UK and US employees at 500+-person firms, fielded November 2025; a security vendor whose product that number sells). That last figure is the agent-shaped one, integration rather than chat use. And 69% of C-level respondents said the speed was worth the security risk, which retires the junior-staff-discipline theory.

Shadow use lives on precisely the tier where the standard reassurance breaks. The reassurance a CTO reaches for — that no major provider trains on enterprise or API data — is true of the estate a firm controls and false of the estate it doesn’t. OpenAI has not trained on API data by default since March 2023. Anthropic’s consumer plans, since 28 August 2025, default to using chats for training unless the user opts out, with five-year retention if they don’t.

What to do

Register first, and buy registration with amnesty rather than enforcement: a window in which anyone can declare an existing agent with no consequence, followed by a sanctioned path genuinely faster than the unsanctioned one. A consultancy, an academic case literature and a research report converge independently on discovery-and-graduation over suppression; BCG’s is the most operational: refactor onto existing archetypes, move to a governed model, register with SBOM and SLAs, attach observability. Nobody has measured whether amnesty actually surfaces hidden agents, and any proposal for one should say so.

The cheap version, this quarter, is two surveys and no tooling: ask workers what they use, compare that against what the firm believes it has deployed, and treat the resulting gap as the planning number in preference to anyone else’s survey.

Then make the sanctioned path the default rather than an option. Microsoft’s environment routing places a maker’s first agent into a policy-enforcing environment at first login instead of detecting it later, and Entra agent blueprints template agent identities so that disabling the blueprint stops every identity it minted from authenticating. Microsoft’s claim that blueprints “prevent shadow/rogue agents” is an overclaim by construction: they constrain agents created through a blueprint and do nothing to one built on a personal API key, which is this page’s entire population, so the mechanism is worth taking and the claim is not.

For the budget conversation: under ISO 27001 an unregistered agent is at once an unowned asset (A.5.9), development outside the SDLC (A.8.25), and code outside secure-coding governance (A.8.28). It is exposure rather than a finding, because whether an auditor writes it up turns on the firm’s Statement of Applicability. IBM’s Cost of a Data Breach 2025 adds the CFO’s number: organizations with high levels of shadow AI averaged $4.63M per breach against roughly $3.96M for those with little or none. That is an organization-level comparison, not a per-breach surcharge; phrased the other way, the CFO hears a different number.

How you’d know it’s working

Registrations keep arriving after the amnesty window closes. A curve that spikes then flatlines means the firm ran a census, not a program.

Newly discovered unregistered agents per quarter falls, and the team can say how each one was found. If every discovery is an incident, the discovery process has failed.

One cheap detection signal, from Chan et al.: flag entities interacting faster than human-average for additional monitoring. CAPTCHAs won’t do this job; the same group finds them unreliable against automation.

What this doesn’t solve

Registration produces visibility rather than safety. A registered agent with the lethal trifecta still has it. Inventory is the precondition for every other control in this wiki and the mitigation for none of them.

Identity schemes are evadable, and the paper proposing them says so: self-hosted agents don’t participate, and lineage links break the moment a user pastes context into a fresh session (“IDs for AI Systems,” 2024). The only enforcement point that holds is the service edge: requiring the identity in order to get access at all, a gateway property rather than a registry one.

The prohibition-fails argument is practitioner consensus, not a measured effect. Davenport and Barkin drop “prohibit” from their strategy fork on practicality grounds, and the academic case literature locates the variable in legibility and friction rather than strictness. But nobody has published a before/after or matched-firm study of the ban-to-shadow elasticity, so it should be written as the mechanism practitioners report.

And none of these numbers give a firm its own rate. EY’s citizen-agent figures (about two-thirds of firms permit employee-led AI development, roughly 60% have formal policies for it, roughly half admit low visibility) come from 975 C-suite leaders at $1B+ firms, not from 20-to-500 person funds, so the published numbers argue that the problem exists while only a firm’s own measurement sizes it.

See also

• Regulatory exposure — why an unregistered agent is a compliance-program problem before it is a security one, chargeable with no incident attached.

• Agent inventory and registry — the direct answer, and the control everything else here depends on.

• Agent sprawl — what the population becomes once visible and unpruned.

• Quality debt and orphaned apps — the debt shadow builds accrue while invisible, and hand over at registration.

• Recordkeeping and compliance gaps — why an unregistered agent on a personal account is an SEC problem too.

• Promotion gates — where amnesty routes what it discovers.

• The support model — why incentives surface hidden use and surveillance doesn’t.

• Agents vs applications — what makes a shadow agent worse than the shadow spreadsheet.