Unmanaged Corporate Bots Can Access And Leak Confidential Data. How Should They Be Managed?

As employees increasingly use AI agents and automated tools without IT oversight, organisations face a growing challenge: protecting sensitive information from systems they may not even know exist.

As employees increasingly use AI agents and automated tools without IT oversight, organisations face a growing challenge: protecting sensitive information from systems they may not even know exist.

Artificial intelligence is becoming part of everyday business operations, but not every tool being used has been approved by an organisation’s IT or security department. Employees can now create automated assistants to summarise documents, manage emails, retrieve information and carry out administrative tasks, often without considering the security implications.

These tools can save time, but they can also introduce risks when connected to corporate systems. An automated assistant with access to internal documents, customer records or company credentials could inadvertently expose confidential information, particularly if its permissions are poorly managed.

 The problem is becoming more difficult as AI agents move beyond answering questions to performing actions independently. Unlike conventional chatbots, these systems can interact with applications, retrieve files and share information with other services.

According to the Microsoft Digital Defense Report 2026, 88 per cent of enterprises are already experimenting with AI agents, while 82 per cent of business leaders plan broader deployments within the next 12 to 18 months. The findings suggest that security teams will increasingly have to manage automated systems alongside human users.

The challenge is not necessarily that these tools are malicious. Rather, organisations may have little visibility into what they can access, where information is being sent or whether they remain active after their original purpose has ended.

This is often described as shadow AI, where employees introduce AI applications or agents without formal approval. As Microsoft explains in its guidance on shadow AI governance, these systems can operate outside established security controls, making them difficult to monitor, audit or disable when necessary.

The risks extend beyond the organisation’s internal network. Research published by internet intelligence company Censys, reported by Axios in October 2026, found that publicly exposed AI-related infrastructure had increased by 63 per cent over nine months, reaching nearly 268,000 systems by July 2026. The findings do not establish that these systems were compromised, but they illustrate how quickly the infrastructure supporting AI tools is expanding.

For chief information security officers (CISOs), managing this exposure begins with understanding which automated tools are operating across the business. Security teams need an inventory of AI agents, including those introduced by individual employees or departments, and a clear record of the applications and information each can access.

Identifying these systems is only the first step. Organisations also need to establish who is responsible for them and whether their permissions are appropriate.

The US National Institute of Standards and Technology (NIST) highlighted this issue in a February 2026 concept paper on software agent identity and authorisation. It identified the importance of establishing reliable identities for automated agents and controlling their access to corporate resources, particularly as they become capable of acting independently.

In practice, this means treating automated agents much like other identities within an organisation. Each should have a defined purpose, an accountable owner and access limited to the information and functions required for its task. Permissions should also be reviewed regularly, with unnecessary access removed when an agent is no longer needed.

The Open Worldwide Application Security Project (OWASP) identifies excessive agency as a significant security risk in AI applications. When an agent has more permissions or autonomy than its task requires, unexpected or manipulated instructions can lead to damaging actions, including the exposure or modification of sensitive information.

Monitoring is equally important. Security teams should be able to see what information an agent retrieves, which systems it interacts with and whether it attempts actions outside its intended role. Logging these activities can help identify unusual behaviour and support investigations if information is exposed.

For higher-risk activities, such as transferring sensitive records or changing critical systems, requiring human approval can provide an additional safeguard.

However, restricting every unapproved tool may not be a sustainable solution. Employees often adopt automation because it makes their work easier, and outright bans can encourage them to find alternative services that are even harder to monitor.

A more practical approach is to provide approved tools that meet genuine business needs while establishing clear rules for their use. Security teams should work with employees to understand which tasks they want to automate and provide secure ways to do so.

As AI agents become more common, organisations will need to extend familiar identity management, access control and monitoring practices to systems that operate with increasing independence.

The objective should not be to prevent employees from using automation, but to ensure that every tool accessing corporate information is visible, accountable and operating within clearly defined limits.

For CISOs, the immediate question is whether their organisations can identify and control the automated systems already working on their behalf. If they cannot, confidential information may be accessible to tools that nobody is actively managing.