The Shadow AI stack: why the controls that catch employee ChatGPT use don’t govern autonomous agents

Shadow AI is no longer a fringe risk. The Verizon 2026 Data Breach Investigations Report names it the third most common non-malicious insider action in DLP data, up roughly four-fold year over year. The World Economic Forum’s 2026 Cybersecurity Outlook reports that 87% of security leaders consider AI-related vulnerabilities the fastest-growing risk in their environment. Netskope’s 2026 data shows the average enterprise generating 223 AI-related data policy violations per month.

And yet, Gartner forecasts that 40% of enterprise applications will embed task-specific AI agents by the end of 2026 \u2014 up from under 5% in 2025. That is not gradual adoption. It is a vertical line.

These two trends are usually discussed under the same heading: Shadow AI. They share that label because both involve AI activity that the security team cannot see, govern, or stop. But the controls required to address them are not the same, and the gap between the two is where most of the 2026 enterprise AI risk now lives.

This note proposes a simple framing. Shadow AI has two layers. Layer 1 is the visible one \u2014 employees using external AI tools through browsers and apps. Layer 2 is the consequential one \u2014 autonomous AI agents acting on systems with execution authority. Most of the security spend currently flowing into Shadow AI is buying Layer 1 protection. Layer 2 remains largely ungoverned.

Layer 1: employees pasting into ChatGPT

Layer 1 is the Shadow AI most security teams already recognize. An engineer pastes proprietary source code into ChatGPT to debug it. A clinician drops patient notes into Claude to draft a summary. A finance analyst uploads a quarterly model into Gemini for an explanation. The data leaves the organization through a browser or app, often through legitimate HTTPS traffic to legitimate cloud services.

The Samsung case in 2023 became the canonical example: three engineers reportedly leaked proprietary semiconductor data by pasting source code, meeting transcripts, and chip yield test sequences into ChatGPT inside a single month. The pattern has since become routine. A 2026 healthcare survey cited by Vectra found that 57% of professionals had encountered or used unauthorized AI tools, including for clinical documentation. Microsoft’s 2026 Cyber Pulse reports that 29% of employees use unsanctioned AI agents and tools at work.

A mature vendor category exists to address Layer 1. Netskope, Zscaler, Palo Alto Networks (Prisma), Microsoft Purview, Harmonic Security, Lasso Security, Nightfall AI, and Nudge Security all sit somewhere on the continuum of CASB, secure web gateway, DLP, and dedicated AI-DLP. Their controls inspect outbound user traffic, classify sensitive content, block or redact prompts containing protected data, and produce a record of which employees used which AI tools.

These products work. They have years of detection engineering behind them. Their unit of analysis is the human user, and their enforcement point is the network path between that user and the external AI service.

The unit of analysis is the human. The control point is the browser. The question being asked is: what did Sarah just paste into ChatGPT?

This is the right shape of control for Layer 1. It is also, structurally, the wrong shape for Layer 2.

Layer 2: autonomous AI agents acting on systems

Layer 2 looks different. The unit of analysis is no longer a human pasting data into a browser. It is a piece of software \u2014 an autonomous AI agent \u2014 making API calls, writing to databases, sending emails, transferring funds, executing code. The agent acts with persistent access and execution authority, often through service identities that do not appear in the normal employee identity inventory. SailPoint, presenting at Gartner Security & Risk Management 2026, framed this as the emergence of a non-human workforce that “acts with execution authority but does not appear in the normal identity inventory.”

Gartner’s 2026 Hype Cycle for Agentic AI describes a category in rapid expansion, where governance and security profiles are only just beginning to emerge alongside the agent technology itself. By early 2026, the Cloud Security Alliance’s Agentic NIST AI RMF Profile reports that organizations were already deploying agents that could write and execute code, manage cloud infrastructure, process financial transactions, and conduct security operations autonomously. OWASP’s 2026 Top 10 for Agentic Applications treats this as a distinct security problem, framing autonomous systems that plan, act, and decide across workflows as fundamentally different from generative AI used as a productivity tool.

Layer 2 incidents are already common. A Gravitee survey of more than 900 executives and technical practitioners in 2026 found that 88% of enterprises reported AI agent security incidents during the year, climbing to 92.7% in healthcare. A Kiteworks survey of 225 enterprise leaders during the same period found that 60% of organizations could not terminate a misbehaving AI agent once it had started operating, and 63% could not enforce limits on what their agents were authorized to do. On May 26, 2026, Gartner published a prediction that 40% of enterprises will demote or decommission autonomous AI agents by 2027 because of governance gaps that only become visible after a production incident.

The unit of analysis at Layer 2 is the agent. The control point is the network boundary between the agent and the systems it acts on. The question being asked is no longer “what did Sarah paste,” but “what action is this autonomous service about to take, against what system, with what authority, under what policy version, with what evidence trail.”

Why Layer 1 controls don’t cover Layer 2

The architectural reason Layer 1 controls don’t cover Layer 2 reduces to a mismatch between what each is designed to inspect and where each is positioned in the request path.

Layer 1 controls inspect outbound user traffic for sensitive data leaving the organization. They sit on the network egress path or in the browser. They are tuned for human-paced traffic patterns, human authentication context, and human-readable content classification. The question they answer is whether the data crossing the boundary should be allowed to leave.

Layer 2 requires something structurally different: runtime policy enforcement at the agent’s action boundary. The relevant inspection is not “is sensitive data leaving,” but “is this action allowed.” A Layer 2 control has to evaluate the action against current policy, run risk scoring, check kill-switch state, hold the action for human approval if required, and produce a tamper-evident record \u2014 all in milliseconds, on every action attempt, with no path for the agent to bypass.

Layer 1 controls cannot do Layer 2 work for the same reason a firewall cannot do code review: the inspection mechanism is in the wrong place, looking at the wrong thing. The reverse is also true. A runtime AI governance layer designed to enforce policy on agent actions is not a replacement for the DLP controls protecting against employees pasting into ChatGPT. The two layers are complementary. Most enterprises currently have only the first one.

Where the analyst guidance is converging

On May 26, 2026, Gartner’s Shiva Varma published guidance arguing that uniform AI agent governance \u2014 treating all agents with the same controls \u2014 leads to enterprise AI agent failure. The recommendation is a proportional governance model that classifies agents by autonomy level, with controls scaled to the agent’s trust boundary and execution authority. An agent that observes needs limited data access and basic logging. An agent that advises needs accuracy checks and bias safeguards. An agent that acts with human approval needs meaningful review, not rubber-stamp prompts. An agent that acts autonomously needs the full runtime governance stack.

This guidance reinforces the two-layer framing. Layer 1 controls are uniform across employee AI usage by design \u2014 the question being inspected is largely the same regardless of which AI tool the employee is using. Layer 2 requires proportional, agent-specific controls because the autonomy levels and execution authorities of agents vary widely. Different controls for different agent classes, evaluated at runtime, with evidence that survives audit.

Independent industry frameworks are converging on similar four-layer descriptions. Arthur.ai’s 2026 governance platform analysis describes a stack with a policy and compliance layer, an AI inventory and lifecycle layer, a runtime enforcement layer, and an observability layer, and notes that most platforms cover only one or two. Vectra explicitly frames “agentic shadow AI” as a distinct risk category from the traditional employee-usage version. The IBM 2025 finding that only 37% of organizations have AI governance policies in place \u2014 leaving 63% operating without guardrails \u2014 applies to both layers, but the gap is sharpest where new controls are required, which is at Layer 2.

A practical assessment for security and risk teams

For enterprise security and risk teams trying to determine whether their current Shadow AI investment covers their actual risk surface, the following five questions distinguish Layer 1 coverage from Layer 2 coverage. The answers separate organizations that are protected from those that believe they are.

An organization that has clear answers to questions one through four likely has Layer 2 coverage. An organization that has a clear answer only to question five \u2014 the DLP question \u2014 is well-protected at Layer 1, and largely exposed at Layer 2.

Why the gap matters in 2026 specifically

Three trends are converging this year to make Layer 2 exposure more consequential than it was in 2025.

First, the agent population is exploding. Gartner’s 40% embedded-agent projection for end of 2026 is supported by deployment data from major vendors: OpenAI reported 1.6 million weekly users of its Codex desktop agent and over 900 million weekly active ChatGPT users earlier this year. NVIDIA’s CEO publicly framed a future in which a 75,000-person enterprise operates alongside 7.5 million agents. Whatever the specific numbers, the population of autonomous agents in enterprise environments is growing orders of magnitude faster than the controls governing them.

Second, the regulatory expectations for runtime evidence are formalizing. The EU AI Act, with its August 2, 2026 high-risk obligations partly extended by the May 2026 Omnibus political agreement, requires technical measures for human oversight, traceability, and accuracy. Italy and Finland already have national enforcement infrastructure in place. NIST’s January 2026 AI Agent Standards Initiative signals that federal U.S. standards are coming. Document-based AI governance programs do not produce the technical evidence these regimes require.

Third, procurement is starting to ask Layer 2 questions explicitly. The vendor security questionnaire that asked “do you have an AI governance policy” in 2024 now asks whether AI agent actions are enforced at runtime, whether incidents can be intervened in during the action, and whether the evidence survives external audit. Enterprises that can answer those questions are starting to win deals their competitors are losing for governance reasons rather than product reasons.

Implications for buyers, vendors, and analysts

For enterprise buyers, the practical implication is that “Shadow AI coverage” is not a single line item. A serious 2026 AI security posture requires Layer 1 controls (a CASB or AI-DLP product for employee usage) and Layer 2 controls (runtime governance for autonomous agents). Either alone leaves substantial exposure. The Layer 1 incumbents are well-known; the Layer 2 vendor landscape is emerging.

For vendors operating in the Shadow AI category, the two-layer framing clarifies positioning. Layer 1 vendors and Layer 2 vendors are not competitors; they are complementary parts of a stack the buyer needs both halves of. Cross-vendor partnerships and integrations \u2014 Layer 1 detection feeding Layer 2 enforcement, Layer 2 audit data feeding Layer 1 visibility \u2014 will likely become a standard reference architecture by 2027.

For analysts and frameworks, the implication is that lumping “AI governance” into a single category masks the architectural distinction that matters for enterprise procurement. The frameworks already moving in this direction \u2014 Arthur.ai’s four-layer stack, Gartner’s proportional governance guidance, the Cloud Security Alliance’s agentic NIST profile, OWASP’s separate Top 10 for Agentic Applications \u2014 are converging on the same observation. The convergence will continue. The buyers most exposed are the ones treating Shadow AI as one category to be solved with one product.

Methodology

This note synthesizes publicly available analyst guidance, industry surveys, and vendor research published between Q4 2025 and Q2 2026. Sources cited include Gartner press releases and Hype Cycle commentary, the World Economic Forum Cybersecurity Outlook 2026, the Verizon 2026 DBIR, the IBM 2025 AI governance survey, Microsoft Cyber Pulse 2026, Netskope’s 2026 enterprise AI data, the Cloud Security Alliance Agentic NIST AI RMF Profile, OWASP’s 2026 Top 10 for Agentic Applications, Arthur.ai’s 2026 platform analysis, and surveys reported by Kiteworks, Gravitee, and Vectra. Where specific numbers are cited, the source is named inline. No survey data was collected by Purogaly for this note.

About Purogaly Research

Purogaly Research publishes industry notes on AI agent governance, runtime enforcement, and the compliance frameworks shaping enterprise AI deployment. Purogaly is the AI agent governance platform built for runtime enforcement and audit-grade evidence. To discuss this note or arrange a briefing, contact research@purogaly.com.