The AI helpers your staff installed without telling IT
Autonomous AI agents are quietly attaching themselves to company accounts, often with wide permissions and no oversight. Here is what that means and how to get a grip on it.
Key points - AI agents, small pieces of software that act on their own inside company systems, are being added to workplace tools by ordinary staff without IT approval. - These agents often connect through OAuth, an approval screen that hands them ongoing access to email and files, sometimes with permission to send, delete or share. - Most companies have no central list of which agents are running or what they can touch. - Standard security tools built for human logins don't spot an agent acting on a user's behalf at three in the morning. - Practical fixes exist: inventory what is already connected, restrict which agents can be approved, and rotate the tokens that keep them logged in.
There's a new kind of software quietly moving into company networks, and most security teams can't see it. Not malware. The AI agent your marketing lead hooked up to their inbox last Tuesday.
An AI agent does more than answer questions: it takes actions. Reading your calendar, drafting replies, filing expenses, moving data between apps. To do any of that, it needs permission to act as you, or alongside you.
That permission usually comes through OAuth, the "Allow this app to access your account" screen you've clicked dozens of times. It's the same mechanism that lets a fitness app read your Google contacts. What's different now is what's on the other end: an autonomous piece of software that can act at machine speed, at any hour, without a human watching.
BleepingComputer flagged the trend this week, citing work by identity vendor Nudge Security. The pattern they describe matches what IAM teams are already seeing: agents spreading across workplace platforms with no central inventory. We've watched this particular corner of the OAuth problem develop across 31 stories in the last 90 days, and the agent angle is genuinely new ground.
How did these agents get inside the company?
Staff added them, usually with two clicks. An employee tries a new AI assistant, signs in with their work account, and approves a consent screen asking for access to mail and drive.
The employee sees a helpful tool. The identity system sees a new application granted a refresh token, a long-lived credential that lets the agent keep logging in for weeks or months without prompting again. Refresh token rotation helps when vendors implement it. Many don't.
Multifactor authentication, the second-step code most companies now require for logins, wouldn't have stopped any of this. The user already passed that check when they clicked approve. MFA is simply the wrong control here.
What can an agent actually do once it's connected?
Whatever the user agreed to. OAuth scopes, the specific permissions listed on the approval screen, are often broad: read all mail, send as the user, modify files. Users skim them. Agents keep them indefinitely.
This is the auth-versus-authz gap in miniature. Authentication proved the human is who they claim to be. Authorisation, the separate question of what the connected app may actually do, gets waved through in the same click.
Should you worry about the agent your colleague installed?
Yes, if nobody has reviewed it. Our July reporting on over-permissioned AI assistants showed how broad account access can turn a routine compromise into something far worse, fast. An unvetted agent holding send-as-user and modify-files access is the same category of risk, just arriving through a consent screen rather than a phishing link.
What should ordinary staff and small businesses do?
Check what's already connected. Both Google and Microsoft let any user view third-party apps linked to their account and revoke them.
| Where to look | What to do |
|---|---|
| Google account: myaccount.google.com/permissions | Remove apps you don't recognise |
| Slack, Salesforce, GitHub | Check installed apps and integrations |
For IT teams, the near-term work is unglamorous: turn off user-level consent for high-risk scopes, require admin approval for new OAuth apps, and rotate tokens on a schedule. None of it is exciting. All of it is overdue.
Common questions
Is an AI agent the same as a chatbot?
No. A chatbot answers you. An agent takes actions on your behalf, which is why the permissions it holds matter far more than the conversation you have with it.
Can I still use AI tools at work safely?
Yes, if your employer approves them and grants only the permissions the tool actually needs. The risk isn't AI itself; it's handing broad account access to software nobody has vetted.
