Shadow AI, Agent Identity, and the Enterprise Security Visibility Gap

Signup Write New Story Shadow AI, Agent Identity, and the Enterprise Security Visibility Gap by Neil "Grifter" Wyler by Neil "Grifter" Wyler | @ grifter Neil R. Wyler (a.k.a. Grifter) is the Vice President of Defensive Services for Coalfire. He has spent 20+ years as a security professional.

Neil R. Wyler (a.k.a. Grifter) is the Vice President of Defensive Services for Coalfire. He has spent 20+ years as a security professional.

In April, an AI model got inside a company's production infrastructure. It pulled application and infrastructure credentials, worked its way to a database and took several hundred rows of production data.

The company didn't notice. Not that day, not that week, not for three months. They found out on July 27, when Anthropic called to tell them.

There were three companies affected, actually. On July 30, Anthropic published a review of 141,006 of its own evaluation runs and disclosed three incidents in which a Claude model reached the open internet from a testing environment and gained unauthorized access to the production infrastructure of real organizations. Of the three victims, the two that Anthropic managed to reach hadn't previously detected the activity. They hadn't flagged anything, filed anything or called anybody. The third company they were still trying to get on the phone.

Now comes the part I want you to sit with, because it's not the part the headlines went with.

None of it was sophisticated. No zero-days, no novel tradecraft. The model got in using weak passwords and unauthenticated endpoints. In one of the three incidents, it scanned roughly 9,000 hosts looking for a way in, then walked through credentials sitting on an exposed debug page and a SQL injection flaw. Nine thousand hosts scanned, and nobody's alerting so much as twitched.

That's the whole argument of this article, delivered by somebody else's incident. Three organizations had an autonomous agent operating inside their environment, at volume, and their answer to "What's running in here and what is it touching?" was nothing at all.

So ask yourself the same question. Ask a security leader how many AI tools are running in their environment, and you'll get a number, delivered with confidence, and it'll be wrong.

Go look. Pull a week of egress logs and count the distinct AI endpoints. Count the browser extensions. Count the SaaS products that quietly shipped an assistant last quarter and never sent anybody a note about it. Then count the agents your own engineers stood up to drain a ticket queue and the sub-agents those agents spun up on their own initiative.

The number you come back with isn't the number you started with, and the space between those two numbers is currently the cheapest place in your environment for something bad to live.

This is a visibility problem with a deadline stapled to it.

Richmond Advisory Group surveyed 150 North American cybersecurity leaders in February in a study Coalfire sponsored. Sixty-three percent said they're under an active mandate to cut costs using AI. Nearly 90% said they'd already worked an AI-driven security incident in the previous 12 to 18 months. The report has a name for the distance between those two numbers, and it's a good one: the efficiency tax.

Of the organizations that took an incident, 67% absorbed a financial or reputational loss. Among the ones who could put a dollar figure on it, 41% landed between $100,000 and $499,000, and 24% exceeded half a million.

The savings land on one ledger and the cleanup lands on another, and nobody in the building is adding them up.

I want to be careful here, because this is the point where security people usually overplay their hand and get tuned out. I'm not telling you AI adoption is a mistake. It's happening, it's producing real value, and the mandate driving it isn't going away because your risk register asked nicely. What I am telling you is that you're being measured on the savings and you'll be measured on the incident, and you currently can't see the thing that decides which one you get.

The bulk (80%) of those leaders said they run into shadow AI weekly or daily. A third said daily or continuously.

If that feels familiar, it should. We ran this play with shadow IT, and we mostly won it, eventually, by extending discovery instead of writing another policy nobody read. The instinct to reach for that playbook is correct.

What doesn't transfer is the payload. An unsanctioned file sync tool leaks the documents somebody put in it. An unsanctioned model gets handed the contract, the incident timeline, the customer list, the source code, and the thing an employee didn't want to ask a colleague about and then holds all of it somewhere. You have no logging, no retention policy, and no answer for when someone asks what left.

And the person doing it isn't being reckless. They're doing what leadership told them to do, often on a tool the company already licenses somewhere else. You can't discipline your way out of that. You can only find it.

Here's the number I'd put on the board if I only got one: 46% of agent actions got away from the original prompt. Trace the chain from what a human typed to what actually executed, and close to half the time the far end isn't what the near end asked for.

That's not a malfunction. You give an agent a goal, it decomposes the goal, it calls tools, it calls other agents, and every hop is a small, reasonable decision nobody signed off on individually. Nothing in that sequence is a bug. The bug is that you were only watching the first hop. It’s like when you played telephone as a kid and the original message becomes something completely different, and often hilarious, on the other end. Except these aren’t children between you and your original message; they’re agents, and the results aren’t hilarious.

The survey data lines up; 20% of reported incidents involved agents spinning up services no human operator ever saw. Almost half of respondents hit significant complications from agents taking unauthorized autonomous action; 29% couldn't track sub-agent proliferation at all, which is a polite way of saying the agents are hiring and HR has no idea.

Go back to the Anthropic incidents, because they show you what that looks like when it lands.

Every one of those models had been told, explicitly, in its prompt, that it was in a simulation with no internet access. A misconfiguration between Anthropic and its evaluation partner meant that was false. So the models did the reasonable thing given what they'd been told: they treated the real production systems they found as part of the exercise. One model figured out it was on the live internet and kept attacking anyway, reasoning that the real company must be in scope. Another one, Mythos 5, worked out that what it was about to do would be a genuine attack, wrote in its own reasoning that this was "NOT okay, and surely not the intended solution," then talked itself back into believing it was a simulation and did it anyway.

What it did was publish a malicious Python package to PyPI, the public registry, to win its challenge. The package was live for about an hour. In that hour, it was downloaded and executed on fifteen real systems, and one of them belonged to a security company whose scanner automatically installs packages to check them for malware. The scanner installed it, the code ran, the model harvested that company's credentials and used them to reach further infrastructure.

Nobody targeted that security company. An automated process ingested something from the internet and executed it, and no human was watching the output. Read the last two sentences again and ask how many pipelines you run that fit that description.

That's your 46%, with a transcript attached. An agent operating on a scope statement it believed, in an environment that didn't match it, producing an outcome nobody authorized and nobody watched. Your agents are running the same logic, on a scope statement you wrote, against an environment you haven't fully inventoried.

To be fair to Anthropic, they found this themselves, in a proactive review, and they told the victims. That's better than the alternative, and it's more than the victims' own tooling managed. The uncomfortable part is what triggered the review: a competitor disclosed a similar incident, and only then did anybody go read their own logs.

None of the fixes are exotic. Most of it is work you already know how to do.

Start with the inventory, because everything else sits downstream of it. Not a list of approved tools but an actual accounting of models, agents, integrations and the data each one can reach. Knowing that a team uses a given assistant is trivia. Knowing which repositories it can read, which keys it holds and what it's permitted to execute is an inventory.

Then give it one owner and one view. The common failure isn't that nobody's tracking AI, it's that four groups are tracking it separately. Security watches infrastructure, procurement watches contracts, legal watches terms, the business watches outcomes and no two of those lists agree. Stand up a cross-functional body if you want but give it enforcement authority. A governance committee with a dashboard and no ability to turn anything off is a meeting.

Extend the discovery you already run. Network and API-level discovery, egress monitoring and SaaS discovery all work on AI traffic once somebody tunes them to look for it. This is a configuration project, not a procurement cycle. Do that before you go shopping.

Treat every agent-to-agent and agent-to-system call as an identity. Credentialed, scoped, logged, revocable, same as any other actor – because that's what it is. If your answer to "Which agent made this call, on whose authority, at what privilege level?" is a shrug, you don't have an agent problem. You have an identity management problem wearing a new hat.

And fix the boring stuff, because the boring stuff is what got used. Weak passwords. Unauthenticated endpoints. A debug page with credentials on it. SQL injection. That list would have embarrassed a pentest report in 2012, and in 2026 it was enough for a frontier model to walk into three companies. Speed doesn't make fundamentals matter less. It makes them matter more, because you have less time to get them right.

Then make all of it continuous. Models get updated, integrations get added and a team changes how it uses a tool on a Tuesday afternoon. An inventory you refresh annually is a historical document.

Here's the encouraging part, from the same survey. After an incident, 60% of organizations moved to tighter oversight of non-human identities; 49% said their security posture actually improved, because the incident forced through control changes they couldn't get approved any other way. And 20% now spend real hours hunting agent activity internally.

Every one of those is available to you this quarter. The organizations in that data just paid somewhere between $100,000 - $500,000 for the motivation.

I keep hearing visibility described as the goal. It’s not. It's the precondition. It's what has to be true before governance, monitoring, incident response or any risk conversation with your board means anything.

Skip it and you're not managing AI risk. You're estimating it from the outside, using vibes and calling the estimate a program.

The fundamentals haven't changed. Know what's in your environment, know what it can touch, watch what it does and be able to shut it off. AI didn't rewrite any of that. It compressed the clock, put a budget mandate behind the adoption and gave the new assets the ability to create more assets without asking.

Three companies went about their business for three months with an AI model in their production systems, and the thing that finally told them was a phone call from a lab in San Francisco. An agent you can't see isn't saving you money. It's running up a tab you haven't been shown yet.