Open Detector Tackles Shadow AI Agents on Enterprise PCs

Researchers behind a November 2026 study said they built an open-source detector for unsanctioned AI agents that may run on enterprise Windows machines. According to the paper by Jeremy Canale and Fabien Soulis, posted by Grafy Research Lab, the goal is to address a governance gap that grows as autonomous LLM agents move from chatbots into action-taking loops. The work matters because once an agent can plan and execute, shadow IT can expand faster than security teams can inventory and retire it.

What the researchers argued about shadow AI

Shadow IT has long meant unapproved technology used inside an organisation. According to the source, the study frames shadow AI as a fast-growing version of that problem. Autonomous AI agents can make shadow IT grow much faster, the authors argue, because agents make building tools nearly free, act with the user's privileges, and leave behind scripts, automations and model-context-protocol servers that are themselves unsanctioned. A simple compounding model, under its assumptions, showed shadow IT growing exponentially once agentic artifacts reproduce faster than the organisation retires them. Retiring them starts with detecting them, the authors write.

The source notes that the first wave of shadow AI was conversational, when employees pasted text into a chatbot in a browser. The second wave is made of agents, software in which a language model, in a loop, decides on actions that tools then execute on the user's machine, with the user's privileges. Coding agents such as Claude Code, Codex and GitHub Copilot's agent mode, desktop agents, AI-native IDEs, local model runtimes and home-made scripts now run on enterprise laptops, often outside any inventory. The authors argue this wave changes how fast shadow IT grows.

What the detector was designed to find

According to the source, the researchers proposed a taxonomy of nine classes of agents and six layers of endpoint footprint. They built Agent Detector, an open-source Windows detector. The approach correlates weak signals around identity: which process talks to which LLM service, whether that process also runs shells, what configuration it carries, what is installed, and what Windows execution history remembers. The source says the detector uses a catalog of 39 tools and 184 LLM endpoint entries. It was deployed with Microsoft Intune, runs hourly as SYSTEM, reads only local state, does not read content and does not block. Instead, it shows a notice that a user must acknowledge and records the acknowledgement.

The design goals include detecting agents without reading content and without blocking. The source describes a detect-and-inform loop that uses a notice. Privacy by design is part of the approach. The source also mentions generic agent rules and network attribution.

Why behavior alone was not enough

Behavioural detection was the obvious route because an agent holds a connection to a remote service and runs commands. The authors argue this is also its limit. According to the source, for every agent there may be a behavioural twin, the same program talking to a non-AI service. Rules based only on process structure and connections cannot separate the two. The source says two behavioural rules flagged every behavioural twin in the evaluation, while Agent Detector flagged none and detected every agent in the majority of runs. Figure 8 shows the notice used when an agent is detected, with fictitious company branding; the user must tick a box before the only button is enabled and the window has no close button.

What the controlled evaluation found

According to the paper, the controlled bench included 12 synthetic agents, 3 AI components and 9 benign workloads, repeated five times on one workstation. The source reports that two behavioural rules flagged every behavioural twin, while Agent Detector flagged none and detected every agent in the majority of runs. The authors state limits: attribution through Windows DNS cache or provider address ranges can be temporal, lasting one to five minutes for a provider behind a shared content-delivery network; an intermittent agent was seen by about one scan in three. A scan cost about 154 ms. The source says the bench was too small to rank detectors; it mapped what each kind of evidence could see, and concluded unsanctioned agents can be partly detected, not by behaviour alone.

The source also discusses deployment with Microsoft Intune, signing, administrator configuration, threats to validity, and a next step for a field study. In the discussion, the authors argue for informing rather than blocking, and they point to legal and ethical questions, data protection, AI literacy and fleet reporting. The paper notes limitations, including privilege and periodicity, the DNS cache, out-of-host execution and catalog drift.

How Grafy readers might engage with the problem

For developers and creators using AI agent tools, the source's concern maps to the workflow around Grafy Code. Coding agents such as Claude Code, Codex and GitHub Copilot's agent mode were named in the source as examples of agents that can run on enterprise laptops. In Grafy, the relevant question is not only whether a model can write code, but what tools, packages or local processes it later leaves behind. Grafy Chat can be a place to compare models for such tasks, though the detector described in the source is a Windows enterprise tool.

Frequently asked questions

What did Agent Detector detect in the controlled evaluation?

According to the paper, Agent Detector flagged none of the behavioural twins and detected every agent in the majority of runs. The two behavioural rules flagged all behavioural twins. The bench included 12 synthetic agents, 3 AI components and 9 benign workloads, repeated five times on one workstation. The authors cautioned that the small bench cannot rank detectors.

How long was DNS-based attribution considered reliable?

The authors said attribution through the Windows DNS cache or dedicated address ranges had a temporal limit. A connection to a provider behind a shared content-delivery network was attributable only while the DNS cache held the provider name, one to five minutes. An intermittent agent was seen by about one scan in three. The scan cost about 154 ms.

Did the controlled evaluation rank different detectors?

No. The source reports that the bench was too small to rank detectors. It instead mapped what each kind of evidence could see. The authors concluded that unsanctioned agents can be partly detected, and not by behaviour alone. The study did not attempt a final leaderboard.

---

Source: Grafy Research Lab — Detecting Shadow AI: Unsanctioned LLM Agents on Enterprise Endpoints: A Taxonomy, an Open Detector and a Controlled Evaluation