What is shadow agent?
In short:A shadow agent is an AI agent running in a company without being registered, owned or reviewed by security. It often uses a personal token or a shared key. Finding shadow agents is the first job most teams face, because nobody can govern an agent they cannot see.
How does it work?
Discovery reads identity providers, SaaS audit logs, code repositories and endpoints. Agent-like behaviour and tokens are matched to people.
What does it look like in practice?
An engineer connects a coding assistant to the production database with a personal access token, and nobody else knows.