Shadow AI agents: what they are and how to find them

The question Which agents run here that we never approved?

What counts as a shadow AI agent

A shadow AI agent is any agent acting with your company's access that security never approved. Often nobody hid it. An engineer installed it to work faster, and it never reached a review.

Five kinds turn up on company machines:

MCP servers are easy to miss, because each one is a single entry in a config file. The MCP docs say a local server “runs with your user account permissions”. What is MCP, and how do MCP servers create risk? covers them in depth, and What is agentic AI security? gives the wider picture.

How they arrive

Each route takes about a minute, and none of them needs a ticket.

• A command-line install. One command, such as npm install -g @anthropic-ai/claude-code, puts an agent on the path. Claude Code's native installer also updates itself in the background.
• An editor extension. VS Code “checks for extension updates and installs them automatically.” In July 2025, version 1.84.0 of the Amazon Q Developer extension for VS Code shipped with an injected prompt. It told the agent “to clear a system to a near-factory state and delete file-system and cloud resources”. AWS says the code failed to run because of a syntax error. BleepingComputer counted nearly one million installs of the extension.
• A package. A package can run its own code the moment it installs. The Nx attack in August 2025 began with a post-install script in malicious versions of the Nx build tool.
• One line in an MCP config file. An entry that runs npx -y with a package name starts that package whenever the app launches, installing it first if needed. The MCP docs' own example works this way, and -y confirms the install without asking. The first malicious MCP server reported in the wild impersonated postmark-mcp on npm and secretly copied emails to an attacker.

Where to look

Check every managed device, and check again on a schedule. Agents, extensions and MCP entries change without anyone filing a request.

Don't stop at the repository. Claude Code's security docs note that reviewing a project's .mcp.json “doesn't show every server a session can load”. User-level settings, connectors and plugins add more.

Blindspot, GIRD's open-source, read-only check, runs these checks on one computer. It lists the coding agents installed, the MCP servers each one starts and any keys sitting in plain text. For a fleet, run the same checks through your MDM.

Why dormant agents matter

An installed agent is a tool that any code on the machine can pick up. If it is still signed in, it works with the developer's access, whether or not anyone uses it.

The Nx attack showed this. On 26 August 2025, attackers published malicious versions of the Nx build system to npm. A post-install script searched each Linux or macOS machine for wallets, keystores, .env files and SSH keys. In Wiz's words, it also “weaponized installed AI CLI tools”. It ran the Claude, Gemini and Amazon Q command-line tools with --dangerously-skip-permissions, --yolo and --trust-all-tools.

The stolen data went to new public repositories in each victim's own GitHub account, named s1ngularity-repository or a numbered variant. Wiz counted over a thousand valid GitHub tokens from the first phase. A second phase used stolen tokens to make private repositories public: over 5,500 repositories across more than 400 users and organisations.

Nobody had to be using those agents that day. They were installed, so the script could run them. In GIRD's 19-day case study, 8 of 14 installed coding agents recorded no session at all. All eight stayed installed.

Dormant agents belong in the inventory, each with an owner and a decision: keep it, restrict it or remove it.

What to do with what you find

1. Give every agent an owner. Record who installed it, who uses it and which team it serves.
2. Approve a short list. Publish it, and make the approved route the easy one.
3. Remove dormant agents first. They hold access, and an unused agent produces no activity for anyone to review.
4. Check what each one can reach. Look at the keys in its config and the MCP tokens it holds. See What can an AI coding agent reach on a laptop? and Where AI agents leak your keys.
5. Scope what stays. Give approved agents only the access their work needs. See Least privilege for AI agents.
6. Keep looking. An agent installs with one command and an MCP server with one config line, so a one-time audit goes stale.