The AI helpers your staff installed without telling IT
Autonomous AI agents are quietly attaching themselves to company accounts, often with wide permissions and no oversight. Here is what that means and how to get a grip on it.
Key points
- AI agents, small pieces of software that act on their own inside company systems, are being added to workplace tools by ordinary staff without IT approval.
- These agents often connect through OAuth, an approval screen that hands them ongoing access to email, files and chat, sometimes with permission to send, delete or share.
- Most companies have no central list of which agents are running, who installed them, or what they can touch.
- Standard security tools built for human logins do not spot an agent acting on a user's behalf at three in the morning.
- Practical fixes exist: inventory what is already connected, restrict which agents can be approved, and rotate the tokens that keep them logged in.
There is a new kind of software quietly moving into company networks, and most security teams cannot see it. It is not malware. It is the AI agent your marketing lead hooked up to their inbox last Tuesday.
An AI agent is a program that does more than answer questions. It takes actions. It reads your calendar, drafts replies, files expenses, moves data between apps. To do any of that, it needs permission to log in as you, or alongside you.
That permission is usually granted through something called OAuth, the "Allow this app to access your account" screen you have clicked a hundred times. OAuth is defined in RFC 6749, and it is the same mechanism that lets a fitness app read your Google contacts. The difference now is what is on the other end: an autonomous piece of software that can act at machine speed, at any hour, without a human watching.
BleepingComputer flagged the trend this week, citing work by identity vendor Nudge Security. The pattern they describe matches what a lot of IAM teams are seeing: agents multiplying inside Google Workspace, Microsoft 365, Slack and Salesforce with no central inventory.
How did these agents get inside the company?
Staff added them. Usually with two clicks. An employee tries a new AI assistant, signs in with their work Google or Microsoft account, and approves a consent screen that asks for access to mail, drive and calendar.
The employee sees a helpful tool. The identity system sees a new application, granted a refresh token, a long-lived key that lets the agent keep logging in for weeks or months without asking again. Refresh token rotation, described in RFC 6749 section 6, helps if the vendor implements it. Many do not.
Multifactor authentication, the second-step code most companies now require, would not have stopped any of this. The user already passed MFA when they clicked approve. Honest answer: MFA is the wrong control here.
What can an agent actually do once it is connected?
Whatever the user said yes to. OAuth scopes, the specific permissions listed on the approval screen, are often broad: read all mail, send as user, modify files. Users skim them. Agents keep them.
This is the auth versus authz gap in miniature. Authentication proved the human is who they say. Authorisation, the separate question of what the connected app is allowed to do, gets waved through in the same click.
What should ordinary staff and small businesses do?
Check what is already connected. Both Google and Microsoft let any user see a list of third-party apps linked to their account, and revoke them.
| Where to look | What to do |
|---|---|
| Google account: myaccount.google.com/permissions | Remove apps you do not recognise |
| Microsoft 365: myapps.microsoft.com | Review consented applications |
| Slack, Salesforce, GitHub | Check installed apps and integrations |
For IT teams, the near-term work is unglamorous: turn off user-level consent for high-risk scopes, require admin approval for new OAuth apps, and start rotating tokens on a schedule. None of it is exciting. All of it is overdue.
Common questions
Is an AI agent the same as a chatbot?
No. A chatbot answers you. An agent takes actions on your behalf, which is why the permissions it holds matter more than the conversation you have with it.
Can I still use AI tools at work safely?
Yes, if your employer approves them and grants only the permissions the tool actually needs. The risk is not AI itself, it is handing broad account access to software nobody has vetted.
