There’s a decent chance someone on your team built an AI agent this week. Not as an approved project, not with a ticket in the backlog, but in a browser tab, using a personal account, stitched together with a no-code tool because it solved a real problem faster than waiting for IT.
This is “shadow AI,” and it’s not a hypothetical. A 2026 PagerDuty survey of 1,250 office professionals found that two-thirds had used AI tools at work despite believing this was not allowed under company policy. Separately, Harmonic Security’s 2026 analysis of nearly 2 million AI sessions found that employees use personal AI accounts for work-related tasks 64.5 percent of the time, activity that sits largely outside company-managed accounts and IT visibility.
The scale of the agent-building itself is just as striking. Nokod Security’s 2026 survey of 200 enterprise CISOs found that security teams can see only 44 percent of the apps, agents, and automations their own business users have built, and that business users now outnumber professional developers by as much as ten to one on these platforms. Guardrails haven’t kept pace either. A 2026 Cloud Security Alliance survey, commissioned by Token Security, found that 82 percent of enterprises discovered a previously unknown AI agent already running in their environment within the past year, with 41 percent saying it happened more than once.
From Shadow IT to Shadow Agents
Shadow IT used to mean someone signing up for a project management tool without asking procurement. Annoying, but contained. Shadow AI agents are different. An agent doesn’t just sit there waiting to be opened. It can read email, pull data from a CRM, trigger workflows, and make decisions on a loop, autonomously, without anyone watching it run.
Industry leaders are already describing this as the next phase of enterprise software. In a 2025 interview on the B2G podcast, Microsoft CEO Satya Nadella said the agent will orchestrate across multiple SaaS applications, comparing the shift to a swarm of agents working the way humans currently operate individual tools. That vision is exciting from a productivity standpoint, but it also means employees are already building their own small versions of this today, with none of the governance such a system would need at scale.
Why Employees Are Doing This Anyway
The survey data points to a few forces converging, not recklessness on employees’ part. The barrier to entry has collapsed: platforms like Microsoft Copilot Studio, Power Automate, and UiPath now let business users build agents that once required an engineering team, which is exactly how Nokod’s ten-to-one ratio of business builders to professional developers came about. Official tools are also lagging behind real demand, and the payoff for building a workaround is immediate and personal, while the risk feels distant.
Friction is close to nonexistent, too. A BlackFog survey of 2,000 workers found that 51 percent had connected an AI tool to work systems or apps without IT’s approval or knowledge, and 63 percent believed it was acceptable to use AI without IT oversight when no company-approved option existed.
Why This Should Matter to Leadership
Data leaves the building without a paper trail. Cyberhaven’s 2025 data analysis found that 27.4 percent of all data employees sent to AI chatbots was sensitive, a 156 percent increase from the prior year’s report. Multiply that across every self-built agent in every department, and you get an unmapped set of pipelines carrying sensitive data outward.
Permissions accumulate invisibly and often outlive their purpose. The same Cloud Security Alliance survey found that only 21 percent of organizations have a formal process for decommissioning AI agents, meaning access and credentials frequently linger long after the agent’s original job is done.
Failures have already shown up, and at real cost. Among organizations in that survey that experienced an AI agent incident, 61 percent reported data exposure, 43 percent reported operational disruption, and 35 percent reported financial losses. These weren’t hypothetical failure modes; they were reported outcomes.
It creates real compliance exposure. A 2026 Cybersecurity Insiders report, based on a survey of 235 CISOs and senior security leaders, found that 75 percent of organizations had discovered unapproved shadow AI tools running in their systems, and 92 percent said they lacked full oversight of their AI identities. A separate Cybernews survey found that nearly a quarter of companies have no official policy on AI tool use at all. In regulated industries, “we didn’t know this agent existed” doesn’t hold up well against numbers like these.
A Composite Example
Picture a sales analyst who builds a small agent to auto-update CRM deal stages from incoming email. It works so well that two colleagues copy the setup within a month. Nine months later, nobody in IT knows these agents exist. One of them, tied to a personal account that gets compromised in an unrelated phishing incident, becomes a quiet entry point into CRM data, because its access was never reviewed. The breach isn’t caused by the AI model. It’s caused by unmanaged automation nobody knew was running.
Where Humaxa Fits In
The answer to shadow AI isn’t to stop employees from building. It is to give them a better place to build.
Employees are already using AI to automate repetitive work, find information, analyze data, generate reports, answer questions, and connect workflows. Increasingly, they also have the technical ability to build agents themselves.
Humaxa gives organizations a way to harness that initiative without turning every employee-created agent into an unmanaged enterprise application.
Humaxa helps organizations identify a high-value workflow, connect the right data and systems, establish access boundaries, build the agent around business knowledge and rules, validate its outputs, and deploy it into the employee’s existing workflow.
The result is a purpose-built AI agent designed around a real business process not simply another chatbot.
Build Quickly. Govern From the Beginning.
Organizations do not need a year-long AI transformation program to get started.
A typical engagement can begin with one question:
What is an employee spending too much time doing?
From there, Humaxa helps define the workflow, connect the relevant data, establish controls, and build and test an agent with the people who actually use it.
The results can be fast and measurable. Vector’s AUTOSAR AI assistant moved from beta to production readiness in under three months. With AutoPacific, Humaxa enabled natural-language access to thousands of data points with ambiguity detection, column verification, and confidence warnings. A technical-support implementation reduced the time required to answer technical questions by 75%.
The goal is not to make every AI project large. It is to make the first useful agent small, fast, secure, and valuable and then make it repeatable.
Give Employees Freedom Without Creating an AI Free-for-All
Instead of asking IT to anticipate every possible AI use case, employees can identify the problems they want to solve.
An employee might need:
“An agent that answers questions about our engineering standards.”
An engineering team might want:
“An agent that analyzes our test results and identifies anomalies.”
A market researcher might need:
“An agent that lets clients ask questions of thousands of survey variables.”
An HR team might want:
“An agent that determines which employees are affected when a policy or certification requirement changes.”
A sales team might need:
“An agent that combines CRM, inventory, product, and dealer information before responding to a customer.”
Different workflows. Different data. One governed foundation.
Humaxa shifts the model from “IT builds every AI tool” to “employees drive the use cases, while the organization provides a secure way to build and operate them.”
From One Agent to an Enterprise AI Ecosystem
The value grows when successful agents can be expanded and reused.
A technical-support agent can become an engineering knowledge assistant. A regulatory agent can incorporate new regulations. An HR agent can connect policy knowledge with employee and certification data.
Humaxa’s enterprise/custom model supports this expansion through managed data, integrations, and customizations.
Organizations can establish common controls for:
- Agent identity and ownership
- Role- and task-based access
- Data and source permissions
- Approved tools and integrations
- Human approval for consequential actions
- Validation, monitoring, and auditability
- Versioning, updates, and retirement
Humaxa doesn’t replace the employee’s idea. It makes the idea enterprise-ready.
And organizations do not have to discard useful work simply because it started as shadow AI. Existing workflows can be assessed, permissions mapped, risks identified, and useful components rebuilt within a controlled architecture.
The employee’s initiative becomes the starting point not the security incident.
The impact can be significant. Opeeka used Max with its proprietary knowledge base and historical proposals; 90% of proposals were ultimately written by Max, contributing to $180,000 in additional revenue within days of adoption. AMP Creative used Max for onboarding, training, scheduling, and tracking, achieving 50% time savings per new employee and a reported 500% ROI.
The Bigger Opportunity
The organizations that win with AI will not necessarily be those with the most AI tools.They will be the organizations that create the fastest safe path from an employee’s idea to a production AI capability.
Employee idea → AI agent → secure deployment → validation → adoption → scale
Instead of:
Employee idea → shadow application → uncontrolled data access → security review after the fact
The difference is not whether employees build. They will.
The difference is whether the organization gives them a trusted path to do it.
Humaxa helps organizations identify valuable use cases, build purpose-specific agents, connect them to authorized enterprise knowledge and systems, establish the right controls, and deploy them where employees already work.
AI innovation can move at the speed of the employee while enterprise security, governance, and accountability remain intact.
That changes the question from:
“How do we stop employees from building AI?”
to:
“How do we let our employees build the AI they need and make sure the best ideas become secure, scalable enterprise capabilities?”
That is the opportunity Humaxa is built to address.
The Main Takeaway
Employees are building AI agents because the tools are good, the need is real, and the official channels haven’t caught up. That combination guarantees shadow AI will keep growing quietly inside every organization that doesn’t address it. The companies that get ahead of this won’t be the ones that ban agent-building outright. They’ll be the ones that make visibility, access control, and a fast, sanctioned path to building agents the default, before an unmanaged one becomes the reason for a very different kind of headline.
