Shadow Agents: The Inventory Problem Nobody's Solved

The shadow agent inventory problem is that the AI agents most likely to cause harm are exactly the ones missing from any inventory: never registered, never reviewed, running anyway. Ask most security teams how many agents are operating in their environment and you'll get a number they don't fully trust, not because they haven't looked, but because a registry built from self-reporting only counts the agents people remember to report. A registered agent, deployed through a known pipeline with a known owner, is already inside whatever review process an organization has. The risk concentrates in the other kind: a script wired up during an incident, a prototype that got merged and never removed, an agent embedded a few dependencies deep in a vendor's product. None of these show up in a self-reported inventory, and they undercount in exactly the direction that matters, since the agents deployed without security's knowledge are, by construction, the ones most likely to be missing guardrails.

Self-reporting can't close the gap

The instinct is to ask teams to register their agents, then build policy on top of that registry. That inverts the actual requirement: a registry built from voluntary disclosure only ever contains the agents someone chose to declare, and asking nicely doesn't produce the ones that matter most.

You cannot govern an agent you cannot see, and you cannot see an agent that has to volunteer itself first.

The alternative is discovery that doesn't require anyone's participation: scanning source code, dependencies, configuration, and running environments directly for the indicators an AI agent leaves behind, imports, system prompts, model client calls, regardless of whether anyone told you it exists.

Visibility is the precondition, not a nice-to-have

An inventory built this way answers the question access control and execution enforcement both depend on: what's actually running, what is it instructed to do, and what can it reach. Skip this step and every downstream control, identity governance, runtime enforcement, is scoped against a map that's already wrong. Shadow agents aren't a compliance footnote. They're the reason the rest of the security stack keeps missing what's actually in production.

Sources

• Playbook: Govern. NIST AI Risk Management Framework. GOVERN 1.6: "Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities."
• AI Risk Management Framework. NIST. The framework the playbook belongs to.