Skip to content
redactsure
Book a demo

Explore.

Explainer · By Chris Sowa · Published
Last updated

What Is AI Agent Discovery and How Do Companies Find Agents They Did Not Approve?

AI agent discovery is the discipline of finding every piece of software that reads an organization's systems and acts on them under a model's direction, approved or not, and recording what each can reach. It rests on a definition of an agent, the signals that identify one, and an inventory record. Without it, governance covers only the agents someone registered.

Scattered computing modules pass discovery and review gates into an enterprise inventory.

AI agent discovery is the discipline of finding every piece of software that reads an organization's systems and acts on them under a model's direction, approved or not, and recording what each can reach. It rests on a definition of an agent, the signals that identify one, and an inventory record. Without it, governance covers only the agents someone registered. The question matters now because agents no longer arrive through procurement. They arrive as a browser extension an analyst installed, a connector switched on in a subscription the company already pays for, or an always-on assistant with its own cloud computer pointed at the shared drive. Each one works inside a legitimate user's session, so the access it has is the access that person has, and nothing in the identity system flags the difference. Discovery produces the list a security team can govern against, so that Least Exposure, under which the AI receives exactly the data a task requires and nothing more, has something to apply to. The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Key findings

  • McKinsey's State of AI 2026 reports 62 percent of organizations experimenting with AI agents and 23 percent scaling them anywhere, which leaves most agent activity in an experimental phase that rarely reaches a register (CX Today, 2026).
  • OpenAI's dots each have a cloud computer and browser and can connect to more than 4,000 apps through plugins; Enterprise, Edu and Healthcare workspaces enable them through administrator controls (The Next Web, 2026).
  • Google's Gemini Enterprise Agent Platform assigns every agent a unique cryptographic ID so that autonomous actions are mapped to a lifecycle owner (Google Cloud, 2026).
  • Microsoft's Copilot Studio documentation warns that when a computer-use agent built with maker-provided credentials is shared, other users can act with the author's access on the machine (Microsoft, 2026).
  • Gartner finds that applying uniform governance across AI agents leads to enterprise agent failure, so an inventory must capture what each agent does and reaches, not only that it exists (Gartner, 2026).
  • Excessive Agency, LLM06 in the OWASP Top 10 for LLM Applications 2025, is defined by what an agent can do rather than by whether it is known, so a discovered agent is governed only once its permissions and actions are recorded (OWASP, 2025).

What counts as an AI agent for discovery purposes?

Discovery fails first on definition. A team that counts only the agents built on its own platform gets a short, wrong inventory. A working definition has to be behavioral: an agent is any software that reads content from an organization's systems, passes that content to a language model, and takes actions in those systems based on the model's output. A chat window reads and passes but does not act; a scheduled script acts but involves no model. An agent does all three, and the combination creates the exposure, because the model decides which actions to take from material it was shown.

Under that definition the population is wider than most teams expect. It includes agents built on a platform such as Amazon Bedrock AgentCore, whose Browser tool lets an agent work web applications through screenshots and the DOM (AWS, 2025). It includes computer-using agents built in low-code tools such as Copilot Studio, which operate web and desktop applications through the user interface (Microsoft, 2026). It includes browser extensions such as Claude in Chrome, where all visible information on the active tab, including personal data, becomes part of the model's context (Claude Help Center, 2026). It includes always-on assistants with their own cloud computers, such as OpenAI's dots (The Next Web, 2026), and connector-driven agents such as Muse for Small Business, which connects to Shopify, Stripe, QuickBooks, Slack, Asana, Notion, Dropbox and Box among others (TechCrunch, 2026).

Two boundary cases need a decision. The first is the assistant that only drafts: it reads and passes, but a person pastes the result. Many teams keep it out of the agent inventory and inside the shadow AI inventory, because the reading step still exposes data; the shadow AI agent is the case that belongs in both. The second is the agent in read-only mode, as dots are during proactive research when the user is away (OpenAI, 2026). Reading counts for discovery, since what the model has read is what a later instruction can turn into an unwanted action, the pattern OWASP names Prompt Injection, LLM01 (OWASP, 2025). The safer rule: count anything that reads systems on a model's behalf, then grade it by what it can do.

Which signals identify an agent?

An agent leaves traces in several systems at once, and no single system shows all of them, so discovery correlates signals across layers. The table below lists the layers a security team already operates, the signal each one yields, and what that signal establishes. Each layer has a blind spot: identity misses agents inside a user's browser session, consoles miss personal accounts, the network sees traffic but not what the model was shown, and people forget.

Layer Signal What it establishes
Identity provider and OAuth Consent grants to AI vendors' apps; service accounts with no human owner; tokens used at machine cadence That an application has been authorized to act with a user's access
SaaS admin consoles Enabled agent features and workspace settings; connector lists; plugin installs Which vendor agents are switched on and what they are connected to
Network and proxy Sessions to model and agent endpoints; cloud-computer traffic that does not originate from a user's device That model-directed traffic is leaving the estate, and from where
Endpoint Browser extensions with screen-capture permission; desktop agents with computer-use capability; unattended machines registered to automation services That software capable of reading and acting on the screen is installed
Application logs Sessions whose action timing and sequence do not match human use; form submissions at machine cadence under a human account That an account is being driven by software
People Amnesty surveys, team interviews, help-desk tickets mentioning an assistant What people are using and why

Identity signals are the strongest because platforms are starting to issue agent identities on purpose. Google's platform assigns every agent a unique cryptographic ID and keeps a registry so that autonomous actions are mapped to a lifecycle owner (Google Cloud, 2026); AgentCore has an Identity component compatible with existing identity providers (AWS, 2025). Where an agent has its own identity, the directory finds it. Where it borrows a person's, the directory does not, and that is the case for every agent that reads the screen under a user's login. The sibling page on AI agent identity takes this further.

Endpoint signals catch the agents identity misses, but only as installed software: an endpoint inventory shows capability rather than reach. Application-log signals are the only ones that show an agent at work, and they show it indirectly, as a human account behaving at machine cadence. NIST's Zero Trust Architecture evaluates every session on its own evidence rather than on the account (NIST, 2020); discovery borrows that stance: the account is not the actor.

What should an agent inventory record hold?

A list of agent names is a start, not an inventory. Gartner's finding that uniform governance across agents leads to failure (Gartner, 2026) implies the opposite requirement: the record has to hold enough about each agent for governance to differ between a read-only summarizer and an agent that submits payments. The fields below let a reviewer answer, for any agent, what it can see, what it can do, and who is accountable.

Field What it records Why it matters
Agent and vendor The product, the model behind it, and whether the model is swappable Contract terms attach to the vendor; exposure attaches to the model
Named owner The person who connected it and answers for its runs An agent with no owner has no one to approve, pause or retire it
Identity used Its own identity, a service account, or a human user's session Determines whether it is visible in the directory and whose access it inherits
Applications reached Each application it can open, as the agent works them Reach through the screen is wider than an API scope
Data classes seen The identifier and record types on the screens or connectors it reads The link to data classification and regulatory scope
Actions permitted Read only; prepare; submit, pay or change a record Excessive Agency is a function of this field
Approval model Which actions stop for a person and whether an always-allow setting exists The difference between delegation and abdication
Exposure treatment Whether values are passed in clear, masked, or tokenized before the model reads them The field that decides what a prompt injection can collect
Record produced Where the log lands and whether it names the approver Whether a run can be reconstructed afterwards
Status and review date Pilot, production, retired; last reviewed Agents accumulate and are rarely switched off

Two fields are routinely left empty, and both matter most. Applications reached is usually filled from the connector list, which understates a browser agent, which reaches whatever the user's login reaches. The companion page on mapping all the data an agent can reach describes the move from a permission inventory to a per-task map. Exposure treatment is usually blank because nobody has checked what the model received. For a screen-reading agent, the honest default entry is "the page, in full": Claude in Chrome places all visible information in context (Claude Help Center, 2026), dots see webpage text and document content within connected apps (OpenAI, 2026), and Muse's agent reads the page in full (Meta AI Research, 2026). Recording that fact per agent does more for exposure than recording a vendor's certifications.

How does discovery become an ongoing discipline?

A one-time sweep finds the agents that existed on the day of the sweep. Agents are added weekly, as features in subscriptions the organization already holds: the first dot is free in Pro and Business Premium plans (The Next Web, 2026), and Muse for Small Business is free with usage limits (TechCrunch, 2026). Most of what follows is experimentation: McKinsey's State of AI 2026 puts 62 percent of organizations experimenting with agents and 23 percent scaling them anywhere (CX Today, 2026). So the discipline has to run continuously, with the inventory as its output and a review cycle as its clock. The NIST AI Risk Management Framework's Map function asks an organization to establish context and inventory the AI systems in scope before it measures or manages their risk (NIST, 2023). For agents, Map is never finished, because the population changes faster than any framework cycle.

Three practices keep the inventory current. The first is to tie discovery to the signals that change: a new OAuth consent to an AI vendor, a new extension with screen-capture permission, a workspace setting flipped to enable an agent feature, a new line on an expense report. Each is an event an existing system can raise, and each should create or update an inventory record. The second is an amnesty, a window in which people declare what they use without penalty; an earlier RedactSure page sets out how to run one, and its yield is a set of inventory records with named owners. People distrust AI and use it anyway, with more than half worldwide saying AI products make them nervous while ChatGPT reaches a billion monthly users (MIT Technology Review, 2026), which is why a ban produces invisibility, not safety. The third is to attach a review date to each record and make the owner, not the security team, responsible for renewing it. An agent whose owner has left has no one to answer for it, and the review date is how that surfaces.

Continuous discovery also changes what security asks of vendors. Microsoft's Copilot Studio documentation describes session replay with screenshots, timestamped action logs and run summaries, exportable and integrated with Purview, with configurable verbosity and retention (Microsoft, 2026). AgentCore's Browser writes session recordings to the customer's own S3 bucket (AWS, 2025). Where the customer holds a run record, the inventory can point to it; where the vendor keeps it, or produces none, the inventory should say so. Paris, Moon and Guo argue that technical verification schemes for AI claims rest on unexamined assumptions and can produce misplaced trust (Paris, Moon and Guo, 2026), which is a reason to want the record in the customer's hands rather than in the vendor's attestation.

What happens after an agent is found?

Discovery ends in a decision per agent, and the inventory record supplies the facts the decision needs. Four outcomes cover most cases. Retire: no owner, no current use, or an owner who cannot say what it does. Allow as is: the agent reads non-sensitive material, takes no consequential action, and has a named owner. Allow with conditions: the agent is useful but its exposure treatment or approval model is inadequate, and the condition is a change to that field. Move into a governed environment: the work is valuable and runs on data the organization will not let a model see in clear, the PII Wall, and the agent is rebuilt where exposure and approval are set by policy.

The decision should run on the record's fields rather than on the vendor's reputation. The Microsoft AI Red Team's taxonomy of failure modes in agentic systems catalogs how agents fail through the interaction of their permissions, inputs and autonomy rather than through any single defect (Microsoft AI Red Team, 2025), and Foundjem and colleagues' catalog of 93 threats from MITRE ATLAS, the AI Incident Database and the literature finds prompt injection and data exfiltration dominant and inference time the heavily targeted stage (Foundjem et al., 2026). Greshake and colleagues showed that an agent can be compromised through content it reads rather than through its prompt (Greshake et al., 2023), which is why the exposure-treatment field decides so much. An agent whose model holds real identifiers has something to lose to an injection; an agent whose model holds tokens does not, and the consequential action still stops for a person.

One further rule: discovery is not a reason to punish the person who switched the agent on. That employee usually found work that mattered. Make that person the named owner and give the work a governed place to run, which turns discovery from a hunt into the intake process for AI work, the only form people will cooperate with twice.

Where does RedactSure sit?

RedactSure gives discovered work a place where the inventory fields are set by policy, not inferred afterwards. An AI co-worker runs inside a governed environment in the cloud the customer's posture requires, with keys the customer holds, across existing applications with no per-application integration and no change to user permissions. The Planner sets which values are tokenized and what the agent may do on each screen, and a named person confirms that policy before the run, so owner, applications, actions and approval model are recorded before the first screen is read. Render-layer tokenization replaces identifiers chosen by policy with consistent tokens such as SSN_001 and ACCT_001 before any model reads the screen; the model receives the task's fields with identifiers as tokens, and real values resolve only at approved destinations at the moment of an approved action. Under Supervised Delegation, the named person approves every payment, submission and record change while the run proceeds.

Every screen as tokens, every action and every approval with a name lands in the AI Control Record and exports to the customer's SIEM. The environment is model agnostic; deployments are in pilot. Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

This page is a definitional synthesis. It rests on vendor documentation and press read as of October 13, 2026: OpenAI's safety write-up for dots and The Next Web's launch coverage, Microsoft's Copilot Studio computer-use documentation and February 2026 blog, AWS documentation for Bedrock AgentCore and its Browser tool, Google Cloud's Gemini Enterprise Agent Platform announcement, the Claude Help Center page on Claude in Chrome, Meta's write-up of Muse's safety design and TechCrunch's coverage of Muse for Small Business. Framework sources are the NIST AI Risk Management Framework, NIST SP 800-207 and the OWASP Top 10 for LLM Applications 2025 entries LLM01 and LLM06. Industry figures come from McKinsey's State of AI 2026 as reported by CX Today, Gartner's May 2026 press release and MIT Technology Review. Research citations are Greshake et al., the Microsoft AI Red Team, Foundjem et al. and Paris, Moon and Guo.

No product was tested, no agent was run and no discovery tool was evaluated; the signal table describes where evidence of an agent can be found in systems an organization already operates, not the output of any product. Vendor features change; the page carries its date and is revised when the sources change. The queue, shared-drive and expense-report examples describe kinds of situations, not any organization. Statements about RedactSure are limited to the design facts the company publishes about itself.

Whether an inventory meets an organization's obligations under any regulatory regime, and which agents it must cover, is a determination for its counsel, assessor, and security and compliance officers, who hold the data classification, risk tolerance and policies it depends on. The frameworks cited set out practices; they do not certify a discovery program.

What the record shows

An organization cannot govern an agent it has not found, and it cannot find agents it has not defined. Discovery begins with a behavioral definition, software that reads systems, passes content to a model and acts, and proceeds by correlating the signals each layer already produces: identity grants, workspace settings, endpoint capability, application sessions at machine cadence, expense lines and what people say when asked without penalty. The output is an inventory record per agent with a named owner, the applications reached, the actions permitted, the approval model, the exposure treatment and where the run record lands. The alternative is a register of the agents someone remembered, with the rest ungoverned. The test a reader can apply is to pick one agent in use and ask for its record: if the owner, the exposure treatment and the approver cannot be named from it, discovery has not happened for that agent.

Frequently asked questions

What is the difference between AI agent discovery and shadow AI discovery?

Shadow AI discovery looks for any unapproved use of AI, including chat tools people paste text into. AI agent discovery is narrower: software that reads an organization's systems, passes content to a model and acts in those systems. The agent subset carries a different risk, because the model decides actions from what it was shown, so the record has to capture actions permitted and the approval model.

Does an agent count if it only reads and never changes anything?

Yes. Reading is the step that exposes data, and an agent that only reads today can be given write access tomorrow with a settings change. OpenAI's dots run proactive research in read-only mode when the user is away, and that reading still places page and document content in the model's context. Record it as read-only and set a review date.

Why does an identity-based inventory miss so many agents?

Because most screen-reading agents borrow a person's identity rather than holding their own. A browser extension or desktop agent works inside the user's logged-in session, issues no new OAuth grant and appears in no directory. Platforms such as Gemini Enterprise and AgentCore assign agents their own identities, which makes those discoverable, but agents that arrive through a subscription feature or an extension have to be found through endpoint and application-log signals.

What is the most important field in an agent inventory record?

The named owner, because every other field depends on someone who can answer for it. The second is exposure treatment: whether the model receives values in clear, masked or tokenized. For a screen-reading agent the accurate default is "the page, in full," which tells a reviewer what a prompt injection could collect.

How often should discovery run?

Continuously, with events as the trigger rather than a calendar. A new consent grant to an AI vendor, a new extension with screen-capture permission, a workspace setting that enables an agent feature or a new AI line on an expense report should each create or update an inventory record. A periodic amnesty catches what the systems miss.

What should happen to the person who switched on an unapproved agent?

They should become the named owner. The agent exists because that person found work worth automating, and the organization now knows about both. Treating discovery as a disciplinary event teaches people to hide the next one; treating it as intake, with the work moved into a governed environment where exposure and approval are set by policy, is the version people cooperate with.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.