All ArticlesRuntime Truth
Visibility & Shadow AI
Threat Explainer

Shadow AI Detection: Surfacing the Unsanctioned AI Your Security Team Cannot See

Discover how shadow AI detection surfaces unsanctioned apps, agents, and MCP servers your security team cannot see. Runtime truth, not configuration guesswork.

Obsidian Editorial Team
Security Research
·
Obsidian Security
·
May 23, 2026
June 1, 2026
Key Takeaways
  • Shadow AI spans three distinct categories: unsanctioned apps, shadow agents, and shadow MCP server connections. Each carries a different blast radius.
  • Configuration is not reality. Most tools show theoretical configuration. Runtime truth reveals effective authority: what agents are actually doing at each moment.
  • 90% of AI agents hold excessive privileges. Without shadow AI detection, those agents operate outside every access control you have.
  • AI agents move data at roughly 16 times the rate of human users. A shadow agent with broad OAuth grants can move sensitive records before any manual review catches it.
  • Detection comes first. You cannot govern what you cannot see. You cannot enforce guardrails on agents you have not inventoried.
  • Non-human identities already outnumber human identities by 25 to 50 times in modern enterprises, and AI agents are the fastest-growing category in that population.

What Is Shadow AI? Defining the Three Categories

Security teams searching for a working definition of shadow AI often land on a single, incomplete answer: employees using ChatGPT without IT approval. That framing captures one slice of the problem. It misses the two categories that carry the highest risk.

Shadow AI breaks into three distinct types, each requiring a different detection approach:

CategoryWhat It IsPrimary RiskShadow AI AppsUnsanctioned GenAI tools used by employees (personal chatbot accounts and similar)Sensitive data submitted in promptsShadow AI AgentsAutonomous agents built on platforms like Copilot Studio or n8n without security oversightActive data access, action chaining, privilege escalation at machine speedShadow MCP ServersUnregistered Model Context Protocol connections linking agents to tools and data sourcesInvisible tool call pathways; agents accessing systems with no audit trail

The critical distinction: shadow AI apps are passive data receivers. An employee pastes a document into a chatbot. That is a data loss event. Shadow AI agents are active. They hold OAuth tokens, execute multi-step workflows, access CRM records, send emails, and modify files. The blast radius of a shadow agent is not a single prompt. It is every action the agent can take with the credentials it inherited.

The machine insider risk posed by shadow agents is what makes this category qualitatively different from the shadow SaaS problem security teams have managed for years. Non-human identities do not log in once and go home. They operate continuously, at machine speed, with inherited credentials that were scoped for a purpose that may no longer match the agent's current behavior.

Why Shadow AI Detection Fails Without Runtime Visibility

Security teams attempting shadow AI detection with existing tools run into the same wall: configuration is not reality.

Network monitoring sees traffic categories, not agent actions. Endpoint tools see the browser, not the agent running inside a SaaS platform. Native platform logs exist, but they are siloed per tenant, require manual correlation, and do not show what an agent is actually authorized to do inside each connected application. The result is ghost chasing: reviewing theoretical configuration signals with no runtime evidence of what actually happened.

The exact mechanism that creates the gap looks like this:

  1. A business user builds a Copilot Studio agent using their own admin-level credentials (maker mode).
  2. The agent is shared org-wide. Any employee can invoke it.
  3. The invoking employee has no direct Salesforce access. The agent does.
  4. The employee asks the agent a question. The agent queries Salesforce using the creator's credentials.
  5. Sensitive CRM data reaches someone who was never provisioned to see it.

Your IAM policy said no. Your access controls said no. The agent said yes. No existing tool flagged the event because every tool saw a legitimate agent making a legitimate API call. This is the machine insider risk that shadow AI detection must surface.

Patterns across enterprise security teams confirm this dynamic. One organization discovered 377 Copilot agents through a security assessment they had no idea existed. Another found 2,500 agents already created across their environment before any inventory existed. These are not edge cases. They are the baseline condition for enterprises that have not yet built a continuous detection program.

The Blast Radius Problem: Shadow Agents vs. Shadow Apps

The blast radius of a shadow AI app is bounded by what one employee can type into a prompt box. The blast radius of a shadow agent is bounded only by the credentials it holds and the tools it can reach.

AI agents move approximately 16 times more data than human users. They operate continuously, without the natural pauses that make human insider risk detectable. They inherit OAuth grants that were scoped broadly at creation and never reviewed. Roughly 90% of agents in enterprise SaaS environments hold excessive privileges relative to what their actual workflows require.

A shadow agent with broad OAuth grants and no security oversight represents machine insider risk: a non-human identity with the access of a privileged user, operating outside every insider risk program your organization runs. Non-human identities already outnumber human identities by 25 to 50 times in modern enterprises. Every new shadow agent widens that gap.

The compounding factor is action chaining. A shadow agent does not take one action. It sequences tool calls across applications, each step expanding its reach. An agent that starts by reading a Salesforce record can proceed to query a connected data warehouse, draft an email, and send it externally. Each individual action looks authorized. The chain does not.

For a full picture of how AI agents create exposure across the SaaS environment, see AI agent security.

How Obsidian Performs Shadow AI Detection Across Your Environment

Obsidian performs shadow AI detection through two complementary acquisition paths, neither of which requires a SaaS connector for every application you run.

Path 1: Browser Extension Telemetry

The Obsidian browser extension captures shadow AI usage at the point of interaction. It identifies when employees submit data to unsanctioned GenAI applications, detects sensitive content in prompts before it leaves the enterprise, and flags personal account usage (an employee moving data to a personal chatbot account, for example) that no network tool can see. Security leaders consistently cite this browser-level visibility into how users interact with generative AI tools, and what documents they may be uploading, as a primary value of the approach.

Path 2: Native API Connections with AI Agent Platforms

For agent-level shadow AI detection, Obsidian connects directly to AI agent platforms including Salesforce Agentforce, Microsoft Copilot Studio, Amazon Bedrock, Google Vertex AI, ChatGPT Enterprise, n8n, and Azure AI Foundry. These connections build a living inventory of every agent: who created it, what connectors it uses, what OAuth scopes it holds, whether its creator account is still active, and whether it is accessible org-wide or publicly.

The output is not a configuration snapshot. It is a runtime authority map showing what each agent can actually do inside each connected application. That distinction is the difference between theoretical configuration and effective authority.

Explore Obsidian's shadow AI management capabilities to see how the detection layer works across platforms.

Shadow MCP Server Discovery: The Visibility Gap Inside the Visibility Gap

Shadow MCP servers represent the most technically complex category of shadow AI detection. Most security teams have not yet inventoried their sanctioned MCP servers. Unsanctioned ones are entirely off the map.

The Model Context Protocol is an emerging open standard that connects AI agents to external tools, data sources, and services. An agent connected to an MCP server can call any tool that server exposes. The tools inside an MCP server are only visible at runtime. Retroactive log review cannot reconstruct what tool calls were made or what data was accessed.

The shadow MCP problem compounds quickly:

  • A developer connects a coding assistant to an MCP server for productivity. The MCP server has access to internal databases.
  • The MCP server is not registered with security. It has no authentication requirement.
  • The agent running through that MCP server now has a pathway to sensitive data that no one approved.

Obsidian builds an MCP server inventory by correlating agent platform connections with runtime behavior. It surfaces sanctioned versus unsanctioned MCP connections, identifies MCP servers connecting to unregistered domains, and flags authentication gaps (MCP connections with no auth mechanism) as high-severity risk factors.

This is the visibility gap inside the visibility gap. You cannot govern what you cannot see. And most organizations cannot see their MCP layer at all.

For context on how this fits a complete inventory practice, see AI agent visibility.

From Detection to Effective Authority: The Single Pane of Glass

Shadow AI detection is the entry point. Effective authority is the destination.

Once Obsidian surfaces every shadow agent, shadow app, and shadow MCP connection, it correlates that inventory against actual SaaS entitlements through a continuously updated correlation layer. That layer maps relationships between human identities, non-human identities, applications, MCP servers, and the models behind them into a single authority map.

The result is a single pane of glass showing:

  • Every agent in your environment: author, creation date, platform, access scope, and whether the creator account is still active (orphaned agents run with inherited credentials even after their creator's account is disabled)
  • Effective authority per agent: not what the configuration says it can do, but what it can actually execute inside each connected SaaS application
  • Toxic combinations: individual risk factors that combine into critical-severity alerts (a shadow agent with org-wide access and a disabled creator account, for example, is not two medium risks; it is one critical risk)
  • Runtime evidence: actual actions taken, data accessed, and identities involved, not theoretical configuration

Probabilistic agents require deterministic guardrails. Detection gives you the inventory. The authority map gives you the evidence. Enforcement, targeting the highest-risk agents first, is the next layer that follows from that foundation. For Microsoft Copilot, runtime guardrails are on the near-term roadmap (Q1 2026), with other supported platforms targeting Q2 2026.

Security teams that have completed a shadow AI detection assessment consistently report the same reaction: the number of agents they did not know existed exceeds the number they did. That gap is where risk lives.

Start with visibility. A structured AI agent risk assessment is a practical way to see what is already running in your environment.

Frequently Asked Questions

What is shadow AI detection and why does it matter in 2026?

Shadow AI detection is the process of discovering unsanctioned AI applications, autonomous AI agents, and unauthorized MCP server connections operating in your enterprise environment without security oversight. It matters because AI agents take autonomous actions, hold OAuth credentials, and access sensitive data at machine speed. Without detection, those agents operate entirely outside your access controls.

How is a shadow AI agent different from a shadow AI app?

A shadow AI app (like a personal chatbot account) receives data passively through prompts. A shadow AI agent acts autonomously: it holds tokens, executes multi-step workflows, queries databases, sends communications, and can chain actions across multiple SaaS applications. The blast radius of a shadow agent is orders of magnitude larger than a shadow app.

Can network monitoring tools detect shadow AI agents?

Network tools see traffic categories, not agent-level actions inside SaaS platforms. They cannot correlate an agent's OAuth grants with its actual SaaS entitlements, identify maker mode credential inheritance, or surface orphaned agents whose creator accounts have been disabled. Runtime visibility at the agent platform layer is required.

What are shadow MCP servers and why are they a security risk?

Shadow MCP servers are Model Context Protocol connections that agents use to access external tools and data sources, deployed without security team knowledge or approval. Because MCP tool calls only occur at runtime, they are invisible to configuration-based tools. An unauthenticated shadow MCP server can give an agent a direct pathway to sensitive internal systems with no audit trail.

Does Obsidian require a SaaS connector for every application to perform shadow AI detection?

No. Obsidian's shadow AI detection operates through browser extension telemetry and native API connections with AI agent platforms. It does not require a connector for every SaaS application in your stack, which means security teams can deploy and get visibility independently.

What is a toxic combination in the context of shadow AI?

A toxic combination is when multiple risk factors appear simultaneously on a single agent, creating compounding, critical-priority risk. A shadow agent (unmanaged, unknown to security) combined with org-wide unrestricted access and a disabled creator account is not three separate medium risks. It is one critical risk requiring immediate action.