The 'Bring Your Own Agent' Era Is Breaking IT Governance

To govern unauthorized AI agents at work, stop treating them like software and start treating them like unmanaged identities: give every agent a scoped, traceable identity tied to a human owner, enforce authorization at runtime instead of at signup, and provide sanctioned tools good enough that people stop reaching for their own.

That's the short version. The long version is that most companies are still writing acceptable-use policies for a problem that outgrew policy months ago.

How many employees are already using unauthorized AI at work?

Start with the scale, because the scale is the story.

• Microsoft and LinkedIn's 2024 Work Trend Index, based on a survey of 31,000 workers across 31 countries, found that 78% of AI users bring their own AI tools to work, rising to 80% at small and midsize companies.¹²
• Gartner tracked the rate of employees using unauthorized AI tools jumping from 41% in 2023 to 68% by 2025.³⁴
• BlackFog surveyed 2,000 workers and found 49% admit using AI without employer approval and 51% have connected AI tools to work systems without IT's knowledge, and a majority of senior leaders say they're fine with it anyway.⁵
• Cybernews put US self-reported unapproved use at 59%, and found that 85% of employees who already have an approved tool use an unapproved one anyway, because the approved one doesn't do what they need.⁶
• Verizon's 2026 Data Breach Investigations Report found that of the 45% of professionals using AI regularly at work, 67% access it through personal, IT-unauthorized accounts, a fourfold increase in that behavior showing up in breach data year over year.⁷

Different surveys, different methodologies, same conclusion: most employees at most companies are already doing this. The question stopped being whether to allow it a while ago.

From copy-pasting into ChatGPT to giving agents standing access

Here's what actually changed, and it's not the percentage. It's the mechanism.

The first wave of shadow AI was a chatbot in a browser tab. An employee copied a paragraph in, got a paragraph back, pasted it somewhere else. Risky, but bounded. A human was in the loop for every action, and the AI never touched anything it wasn't handed directly.

That era is over. Agentic browsers and agent modes, ChatGPT Atlas being the clearest example, let an AI act directly inside a user's logged-in accounts: Gmail, Calendar, Drive, whatever tabs are open. Security researchers at Zenity Labs describe the shift plainly: when agent mode is enabled, the AI takes over the browser, which expands the blast radius of a single corrupted prompt from a bad conversation into full account compromise, because the agent is designed to navigate anywhere on the open web and there's no way to block it from doing so.⁸

That's the actual new risk this piece is about. It isn't another unapproved SaaS subscription showing up on a corporate card. It's an autonomous process with a live session token, running on someone's behalf, with no ticket, no owner of record, and no expiration date. We've written before about how employees are quietly running long-lived AI agents from the CLI rather than chatting with them one prompt at a time. The browser-agent version of that same pattern just happens to sit on top of someone's actual inbox.

Why can't CASB, DLP, and SSO control AI agents?

CASB, DLP, and SSO were all built on the same assumption: a human logs in, gets a static set of permissions, and IT can see the login. That model has held up reasonably well for twenty years of SaaS sprawl.

Agents don't fit it. They request new tools and datasets mid-task rather than at provisioning time. Credentials get granted once and rarely re-evaluated. And when something goes wrong, the logs frequently can't show who authorized the action in the first place, according to TechTarget's analysis of agentic access controls.⁹ A 2026 Cloud Security Alliance survey of nearly 400 IT and security professionals, sponsored by Oasis Security, found 79% rate their confidence as low to moderate in defending against attacks routed through these non-human identities, and more than 16% don't even track when a new AI-related identity gets created.⁹¹⁰

You can't govern what your access model can't see. That's the whole problem in one sentence.

How much is shadow AI already costing companies?

This isn't hypothetical. IBM's 2025 Cost of a Data Breach Report formally added shadow AI as a breach-cost category for the first time. Organizations with high shadow AI involvement saw average breach costs of $4.63 million, about $670,000 above the global average, and took a median 247 days to detect the incident.¹¹¹² 97% of AI-related breaches in the study involved systems that lacked proper access controls, and 63% of breached organizations had no AI governance policy at all.¹¹¹²

The real-world incidents predate even that data. Samsung banned ChatGPT company-wide in 2023 after an engineer uploaded sensitive internal source code to it; JPMorgan Chase, Bank of America, Citigroup, Deutsche Bank, Wells Fargo, Goldman Sachs, and Amazon issued similar restrictions the same year.¹³ Those were blunt, blanket bans written for chatbots. Nobody at those companies has since written a comparable policy for an agent that can act inside a logged-in account. That gap is where the money in the IBM report is coming from.

The identity blind spot: who authorized the agent?

Here's the number that should worry every CISO more than any single breach figure: non-human identities (service accounts, API keys, OAuth tokens, agent credentials) already outnumber human identities by roughly 45 to 1 on average across the enterprise, and by as much as 144 to 1 in cloud-native environments.¹⁴¹⁰ Only 15 to 18% of security leaders feel highly confident their identity systems can manage or prevent attacks through these identities.¹⁰

Worse: only 28% of organizations can trace an AI agent's actions back to a human sponsor across all their environments, and 92% say their legacy IAM tools simply cannot manage AI or non-human-identity risk.¹⁴ Put those two numbers together and you get the real definition of an ungoverned agent: not one running a dangerous task, but one nobody can name a human owner for. We've called this the accountability gap in agent swarms with no registry, no identity, and no owner, and it's the actual crux of why 'unauthorized AI agent' is a governance category IT hasn't built controls for yet.

How do you actually govern unauthorized AI agents at work?

Banning tools doesn't work when 71% of enterprise generative AI connections already run through personal, non-corporate accounts.¹⁵ You can't block what you can't see, and employees will route around a block anyway. The fix has to work at the identity layer, not the policy-document layer.

1. Give every agent its own identity. Not a shared service account, not a human's OAuth token borrowed for convenience. A distinct, scoped identity that maps to exactly one accountable human sponsor, so "who authorized this" has an actual answer.
2. Authorize at runtime, not at provisioning. Static permissions granted once and forgotten are the exact gap agents exploit when they request new tools or data mid-task. Access decisions need to happen when the agent asks, not before.
3. Build a machine-native audit trail. Human-oriented logs weren't designed to capture an agent's chain of actions across tools. If your logs can't reconstruct what an agent did and why, you don't have oversight, you have a hope.
4. Set delegated authority limits, not blanket access. An agent acting on someone's behalf should inherit a bounded slice of that person's permissions, not their full account.
5. Provision a sanctioned alternative that's actually good. This is the part most policies skip, and it's the part with the strongest evidence behind it: giving employees a well-designed, sanctioned AI tool cuts unauthorized use by roughly 89%, according to CSA's synthesis of vendor telemetry.¹⁵ People aren't going around IT out of malice. They're going around IT because the approved option is worse than the one they found themselves, which tracks with the 85% of employees who use unapproved tools despite already having an approved one.⁶
6. Write the AI acceptable-use policy as a living document, not a PDF. Static policies can't keep pace with agents that gain capabilities through updates the vendor ships, not the employee. Revisit it quarterly, tied to what your identity logs are actually showing you.

A governance framework like this only works if it's treated as infrastructure, which we've laid out in more detail as a step-by-step framework for securing the agents employees build. The pattern holds whether the agent in question is wired into a database, a browser session, or a CLI running unattended for days.

Why this is a Software Ownership problem, not just a security one

Here's my honest take after watching a few of these rollouts up close: the instinct to fix this with a stricter policy is understandable and wrong. You cannot out-write behavior that's driven by employees having a genuinely better tool than the one you gave them. The 78% BYOAI figure isn't a compliance failure so much as a procurement failure.¹

The deeper issue is that most companies are trying to govern agent behavior on infrastructure they don't own. Every time an employee grants a consumer AI product standing access to their inbox, the company is renting trust to a platform whose identity model, audit trail, and incident response are entirely out of its hands. That's the same rent-versus-own tradeoff this publication keeps coming back to, just applied one layer down, at the agent instead of the app.

If you're going to have employees running autonomous agents against company data anyway, and they are, the more durable fix is bringing that agent infrastructure in-house: owning the identity layer, the audit trail, and the authorization logic instead of hoping a browser vendor's defaults protect you. That's the case for running agent access through a platform like Remy built for exactly this problem, rather than accepting whatever identity model a consumer AI product ships with by default.

The agents aren't going away. Neither is the pressure that's making employees adopt them faster than IT can approve anything. The companies that get ahead of this will be the ones that stop asking "how do we stop this" and start asking "who owns the identity behind it." Everyone else will read about their breach cost in next year's IBM report.