Microsoft warns: Almost one in three employees use unapproved AI agents at work

Microsoft states that AI agents are rapidly turning into ‘digital colleagues’ in companies, and more than 80 percent of Fortune 500 companies use them. The problem is that agents are often created outside the IT department, through low code and no code tools, so organizations sometimes don’t even see them, let alone monitor them. In the Microsoft ecosystem, agents are built and deployed through multiple platforms, from Fabric and Foundry to Copilot Studio and Agent Builder, which further accelerates their deployment.

The report emphasizes that the adoption of agents is spreading globally and that Europe, the Middle East and Africa account for 42 percent of active AI agents, followed by the USA with 29 percent, Asia with 19 percent and the Americas with 10 percent. The growth is particularly pronounced in sectors where there is a lot of process and regulation, after software and technology development, which accounts for 16 percent, manufacturing is at 13 percent of global use, financial services at 11 percent, and retail at 9 percent. Agents are used in these industries to create proposals, analyze financial data, triage security alerts, automate repetitive processes, and quickly extract insights from data.

The most sensitive part of the story is what Microsoft describes as ‘shadow AI’, a situation where agents are used without authorization, clear rules and authority controls. When an agent has too broad privileges or receives incorrect input, it can become a vulnerability, and even an unintended ‘double agent’ that can be abused. The report therefore emphasizes that agents should be assigned clear roles, limited privileges and continuous monitoring, similar to people and IT systems. One of the key risk signals is the fact that 29 percent of employees reach out to unapproved agents.

Regional Director for Technology at Microsoft Tomislav Vračić he said that innovation and security must progress at the same speed, and that without rules, visibility and accountability, agents can become a serious security problem. In practice, this means that agent management should not be reduced to ‘let IT solve it’, but should be asked as a business issue, with clear rules and responsibility. In the report, Microsoft also emphasizes the Zero Trust approach and centralized management as a framework for reducing risk and strengthening trust.

In Cyber ​​Pulse, it is further emphasized that managing AI is not only the job of IT or CISO, but a joint responsibility that includes lawyers, HR, data teams, business leadership and administration. As a warning, data from Microsoft’s Data Security Index states that only 47 percent of organizations introduce specific security controls for generative AI. The conclusion of the report is that security and innovation are not opposites, but that good governance creates transparency, and transparency becomes a competitive advantage, especially in an increasingly regulated digital environment.