AI Agents Are the New Insider Threat: What Every Business Leader Needs to Know

Here is a scenario playing out in companies right now. A well-meaning employee installs an AI assistant that connects to their inbox and calendar to "handle the busywork." It reads every email. It can send messages, create calendar invites, and access shared drives. Nobody in IT approved it. Nobody in security knows it exists. And last Tuesday, it summarized a confidential thread about an upcoming acquisition and pasted it into a chat with an external vendor, because the employee asked it to "catch the vendor up on context."

No hacker broke in. No password was stolen. The threat was invited in, given the keys, and left running overnight.

This is the story the security industry told all through 2026. Forrester's 2026 threat list, Google Cloud's Cybersecurity Forecast 2026, and Anthropic's September 2026 threat intelligence report all converged on the same warning: the most urgent new risk is not what adversaries do with AI, it is what enterprises are doing to themselves by deploying AI agents without governance. Forrester's analyst Jitin Shabadu put it bluntly: personal AI agents are infiltrating enterprises and operating as shadow operators at machine speed, outside security governance, with CISOs left accountable for activity they cannot see.

If you run a business, this is a governance problem first and a technology problem second. Here is what is happening, why your current controls cannot see it, and the five controls that actually work.

Key takeaways

• "Shadow agents": employees independently deploying autonomous AI agents for work tasks, regardless of approval, creating invisible pipelines for sensitive data (Google Cloud Cybersecurity Forecast 2026).
• Forrester's 2026 list puts AI agent threats at the top of CISO concerns, shifting focus from external attackers to risks enterprises introduced themselves.
• Once an agent starts a harmful action, only about 9 percent of organizations can stop it before it completes; 32 percent have no visibility into agent actions at all (2026 industry survey).
• Anthropic's September 2026 threat report found the "agentic operator" model, AI agents autonomously running attacks for hours or days, has spread to every class of threat actor.
• The fix is governance, not prohibition: agent inventories, least-privilege permissions, human checkpoints for consequential actions, and logging tuned to agentic behaviour.

From shadow AI to shadow agents: what changed

"Shadow AI" was already a headache: employees pasting confidential data into consumer chatbots. Shadow agents are a different species. As Google Cloud's forecast describes it, these are autonomous action-takers, not passive tools. A chatbot answers questions. An agent sends emails, modifies records, triggers workflows, and chains tools together, potentially without human review.

The difference matters because the blast radius is different. A leaked prompt is embarrassing. An agent with write access to your CRM, your finance system, and your email can move data, change records, and message customers while everyone is asleep. One unsanctioned agent can exfiltrate sensitive data through a misinterpreted task, as the forecast warns, creating data leaks, compliance violations, and IP theft from a single well-intentioned install.

And this is not a future risk. A 2026 industry survey found 37 percent of organizations had already experienced AI agent-caused operational issues in the past twelve months, with 8 percent serious enough to cause outages or data corruption. The top runaway fear, cited by 38 percent: an agent autonomously moving data to an untrusted location.

Why agents slip past every control you have

Your security stack was built for humans. Agents break its assumptions one by one:

Identity. Legacy identity and access management was designed around named people: session-based logins, MFA enrollment, role-based access tied to a human. An AI agent calling an internal API from a third-party platform has none of those anchors. It acts through delegated credentials and API tokens that often never trigger an MFA prompt. Forrester calls the result "AI identity sprawl": non-human identities acting inside your environment with no IAM system designed to track them.

Visibility. Agents do not create the session logs your SIEM knows how to parse. Their activity arrives as API calls, webhook events, and service-account actions that look like background noise. The survey numbers are stark: once an agent initiates a harmful action, only 9 percent of organizations can intervene before it completes. About 24 percent can block some agent actions but not all, 35 percent would find the action only in logs after the fact, and 32 percent have no visibility into agent actions whatsoever. Picture the SOC analyst arriving Monday morning, tracing an anomalous privilege change to a service account an agent created 72 hours earlier. Every action is in the logs. No alert ever fired, because no detection rule existed for agent-initiated behaviour.

Persistence. Humans log off. Agents do not. An agent keeps polling, retrying, and executing on its schedule, not yours. A compromised or manipulated agent works weekends.

Manipulability. Agents read the world to do their jobs, and the world can lie to them. Prompt injection, hiding malicious instructions in an email, document, or webpage the agent processes, can redirect a trusted agent toward exfiltration. In mid-2025, the EchoLeak vulnerability (CVE-2025-32711, rated 9.3 out of 10 in severity) demonstrated a zero-click prompt injection against Microsoft 365 Copilot that enabled enterprise data exfiltration without any user interaction. In early 2026, researchers disclosed the Reprompt attack, which chained techniques to turn Copilot into a single-click data exfiltration channel. Your agent's permissions become the attacker's permissions.

This is the insider threat reimagined: not a malicious employee, but a diligent one whose helpful agent can be steered, and whose actions nobody is watching.

The three fronts every leader should name

Forrester's framing is useful because it splits one overwhelming problem into three governable pieces:

1. Internal agents your organization deploys. The sanctioned ones. These you can design well, if you choose to: scoped permissions, logging, oversight checkpoints.
2. Inbound agents calling your APIs from outside. Partners' and vendors' agents now knock on your digital door. Each one is a non-human identity your IAM was never designed to vet.
3. Outbound agents your employees use to reach external services. The shadow agents. Browser extensions, inbox assistants, workflow automations, adopted team by team with no central inventory.

Most organizations have addressed none of the three. The starting point is simply naming which of your systems each front touches, then applying the playbook below.

The governance playbook: five controls that actually work

This is not developer advice. These are decisions for leadership, legal, and operations.

1. Build an agent inventory. You cannot govern what you cannot see. Require registration of every agent with access to company systems: what it does, what data it touches, who owns it, and what credentials it holds. Discovery will be uncomfortable; most companies find agents they never approved. That discomfort is the point.

2. Enforce least privilege, aggressively. An agent should have no broader access than a human in the same role would need, and ideally narrower. A scheduling agent does not need the finance share. A support agent does not need export rights. Review agent permissions quarterly, because agents accumulate access the way employees accumulate keys.

3. Require human checkpoints for consequential actions. Purchases, external communications, data exports, permission changes, anything irreversible should pause for human approval. Autonomy is the product's selling point and its risk; the checkpoint is where you keep the benefit and contain the risk. Note the survey finding: only about 9 percent of organizations can currently intervene mid-action. Build the pause into the workflow, not into a hope.

4. Log and audit agent behaviour like human behaviour. Retain logs that allow forensic reconstruction of what an agent did and why, not just snapshots of individual actions. Tune anomaly detection for agentic patterns: unusual session volumes, rapid session cycling, repetitive narrow query scopes, and activity at hours no human works. Ask your vendors whether their safety systems do cross-session behavioural analysis, not just per-session content checks.

5. Give people a sanctioned path. Blocking shadow agents does not work; it just drives them underground. Provide an approved agent platform with the controls above built in, publish a clear policy on what agents may and may not touch, and make the approved path easier than the rogue one. Convenience is a security control.

One more principle from Anthropic's September 2026 analysis, worth quoting in spirit: vet your AI vendors on whether safeguards, scoped permissions, and human oversight are architectural commitments, not marketing language. If the vendor cannot show you the controls, you cannot inherit them.

What this means for Canadian businesses specifically

Canada's privacy regime makes this more than an IT issue. An agent that moves customer data to an untrusted location or an unapproved foreign service can trigger breach-notification obligations under PIPEDA and provincial privacy laws. Document your agent inventory and your controls now; "we did not know the agent existed" is not a defence regulators accept, and it will not satisfy a customer asking where their data went.

Smaller businesses are not exempt. You may have fewer agents, but you also have thinner monitoring, which means a single shadow agent represents a larger share of your total risk. The five controls above scale down fine: a one-page agent register and a rule that nothing sends external email without a human glance will cover most of a ten-person company.

For the developer's-eye view of how these same agent risks play out in code, see our companion piece on AI coding agents and the security mistakes developers are making.

Practical next steps

• This week: Ask IT for a list of every AI agent, assistant, or automation with access to company email, files, or customer data. Include browser extensions and personal productivity tools. Expect surprises.
• This month: Apply least privilege to the agents you found. Remove write and export access wherever it is not essential. Turn on the most detailed logging your platforms offer.
• This quarter: Publish a short AI agent policy: what needs approval, what data agents may touch, and which actions require a human checkpoint. Add agent behaviour to your incident-response plan, because "the agent did it at 3 AM" is now a plausible incident summary.
• Ongoing: Re-audit quarterly. Agents get new capabilities through updates; a read-only assistant in January can become a workflow-automation tool by June.

The bottom line

The insider threat of 2026 does not sneak in through a firewall. It gets invited in by your own people, handed legitimate credentials, and left to work unsupervised. AI agents are not going away, and they should not: used well, they are genuinely useful. But autonomy without governance is just risk with a productivity story attached. Inventory your agents, scope their permissions, keep a human in the loop for anything consequential, and log everything. The companies that do this now will keep the benefits. The ones that do not will meet their insider threat at 3 AM on a Saturday.

Sources

• ITWeb / ADG, "Shadow agents are the autonomous AI threat organisations cannot ignore in 2026" (Google Cloud Cybersecurity Forecast 2026): https://www.itweb.co.za/article/shadow-agents-are-the-autonomous-ai-threat-organisations-cannot-ignore-in-2026/O2rQGMAEjKKMd1ea
• Cybersecurity Insiders, "Forrester 2026: AI Agent Threats Top CISO Risk List": https://www.cybersecurity-insiders.com/forrester-2026-ai-agent-threats-ciso-risk/
• Anablock analysis of Anthropic's September 2026 Threat Intelligence Report ("agentic operator" threat): https://blog.anablock.com/blog/inside-anthropics-september-2026-threat-intelligence-report-what-every-business-deploying-ai-nee
• Cybersecurity Insiders, "New Research Exposes AI Risk and Readiness Gap 2026" (intervention and visibility statistics): https://www.cybersecurity-insiders.com/ai-risk-and-readiness-report-2026/
• Content.fans, "AI Agents: Security, Not Speed, Drives Enterprise Adoption in 2026" (tool abuse, identity misuse, supply-chain compromise): https://content.fans/news/ai-agents-security-not-speed-drives-enterprise-adoption-in-2026