Unmanaged Agents

Unmanaged Agents provides visibility into AI agents and agentic activity detected through supported endpoint discovery mechanisms that are not currently part of the organization's managed AI agent inventory.

These agents can represent Shadow AI - AI agents, applications, scripts, or automations operating within the enterprise that have not been formally discovered, onboarded, or brought under the organization's established visibility and governance processes.

Unmanaged Agents helps security and IT teams identify this activity, understand where it is occurring, investigate the available detection context, and determine whether the detected agent should be sanctioned or further investigated.

What are Shadow AI Agents?

AI agents can enter an enterprise through many paths. Developers may install coding agents, teams may build their own AI-powered applications, scripts may interact directly with LLM services, and users may access agentic applications through browsers.

When this activity occurs outside established AI onboarding and governance processes, security teams may have limited visibility into:
  • What AI agents are operating in the environment
  • Where the agent was detected and which user or endpoint is associated with it
  • What AI platform or service the agent is interacting with
  • What activity led to the detection
  • Whether the agent is known and approved by the organization
Agent Identity Security uses supported discovery mechanisms to surface this activity as Unmanaged Agents, providing security teams with a starting point for investigating potential Shadow AI usage.
Important: An Unmanaged Agent represents detected AI agent activity that is not currently managed within Agent Identity Security. Its presence does not by itself mean that the agent is malicious or prohibited. Organizations can review the available detection context and determine how the agent should be handled.

Examples of Shadow AI Agents

Shadow AI is not limited to installed AI applications. It can include persistent applications as well as lightweight or short-lived AI activity.

Example Scenario
AI coding agent A developer installs or uses an AI coding agent on an enterprise endpoint without it being formally onboarded or approved.
LLM-powered script or automation A Python, PowerShell, or other script calls an LLM or cloud AI service to analyze information, generate content, make decisions, or perform a task. This can include short-lived scripts that execute and terminate quickly.
Custom or framework-based agent A developer builds or runs an agent using an AI framework or SDK without registering it through the organization's established AI governance process.
Browser-based AI agent A user accesses an AI agent or agentic application through a browser or PWA without the agent being part of the organization's managed AI inventory.
AI-enabled enterprise automation A team creates an automation that uses an LLM to process information or perform actions across enterprise systems without going through the established onboarding process.

Shadow AI may not always appear as a permanently installed application. For example, a developer could execute a short-lived Python script that calls an LLM service, processes the response, and terminates. This can still represent Shadow AI activity even though there is no persistent AI application running on the endpoint.