AI agents are becoming an identity and access risk for security teams, but shadow agents are becoming another headache for enterprises and MSSPs alike. This is a new AI governance problem for MSSPs and security teams - employees building AI agents inside workplace tools faster than security teams can inventory them - and if no one is tracking those agents, they can create security, compliance, and operational risks.
Nudge Security is trying to address that gap with a browser-based discovery capability for shadow AI agents. The Austin, Texas-based company said the new feature will extend AI agent visibility beyond platform APIs, which are often limited or unavailable in newer agent-building tools.
The company says the feature can find AI agents built in tools such as Airbyte, Atlassian Rovo, ChatGPT Workspace Agents, Cursor Automations, HyperAgent Agents, OpenAI Workflows, Retool Agents, Zapier Agents, and Zoom Workflows.
Why API-only discovery leaves gaps
Security teams have seen this problem before. An employee signs up for a SaaS app, connects it to company data, and IT finds out later through spending records, OAuth permissions, browser activity, identity logs, or network tools. AI agents create a similar problem, but with bigger stakes.
These agents can keep permissions, connect to business apps and data, and run tasks on their own. Some may move data, trigger workflows, or call other tools. Others may make decisions based on prompts, instructions, and connected services. That means an AI agent is not just another app to track. It can become part of how work gets done.
The challenge is visibility. If an AI platform has a strong public API, security tools can use it to find agents, owners, and permissions. But many agent-building platforms are still moving faster than their APIs. Some expose limited data. Others do not give security teams an easy way to see which agents exist.
Danielle Russell, VP of product at Nudge Security, told MSSP Alert that this is a real issue for MSSPs as many already have incomplete SaaS inventories, messy identity data, and customer environments that are hard to monitor.
“For MSSPs, browser-based discovery of shadow AI agents extends agentic AI visibility to cover platforms that don’t yet offer a robust API that AI governance tools like Nudge Security can use to uncover agents. Instead of accepting blind spots while waiting for new tools to mature their APIs, this approach enables Nudge Security and the MSSPs that use it to keep up with the rapidly evolving market of platforms that offer agentic AI capabilities.”
What the browser extension changes
The browser has become an important control point for SaaS and AI governance because much of the work happens there. Nudge already uses a browser extension for AI governance and identity security, and this new agent discovery feature builds on that model. Instead of relying only on what an application API exposes, the browser extension passively observes relevant agent context when an employee views, lists or creates an AI agent in a supported platform. The platform then adds the agent to the organization’s AI agent inventory, maps it to the human creator, and enriches it with governance and risk insights.
Russell said the deployment model is intended to keep that added visibility from becoming another heavy lift for security teams or service providers.
“The lightweight Nudge Security browser extension can be deployed with minimal operational burden through your MDM,” Russell said. “It supports Chrome, Edge, and other chromium-based browsers, AI browsers like Comet and Atlas, Firefox, and Safari.”
That browser coverage could matter for partners supporting customers with mixed endpoint fleets, multiple browsers, and different management maturity levels. But the model still depends on deployment coverage and customer adoption. Agents created or managed outside the extension’s reach may still require API discovery, identity data, SaaS telemetry, or other controls.
Scaling agent governance across customers
For MSSPs, the bigger question is not only whether they can find shadow AI agents. It is whether they can turn that discovery into a repeatable service for many customers. Russell said the feature is built for both enterprise security teams and MSSPs. Once the browser extension is deployed, new AI agent details appear in the Nudge Security dashboard as users interact with them. Partners can also set alerts and use nudges to guide users toward safer behavior.
“Nudge Security’s browser-based AI agent discovery is built for scale,” Russell said. “After the browser extension is deployed, details on new AI agents are added to the Nudge Security dashboard as users interact with them, with the ability to configure alerts and nudge users towards secure practices.”
That could help MSSPs build an AI governance service around regular reviews. They could find new agents, connect them to technical owners, check risky settings, track fixes, and ask users for more context. It is close to work, many MSSPs already do around SaaS security, identity governance, and risky OAuth permissions.
Russell said Nudge surfaces risks such as “publicly accessible agents, hardcoded credentials, unauthenticated MCP connections, high-risk integrations, and orphaned agents that have outlived their creators,” with the ability to nudge the technical contact for the agent to resolve issues and provide more information.
AI agent security is still new. There is no clear way to define an enterprise AI agent, track who owns it, compare permissions across platforms, or rate risk. Some agents may be simple workflow tools. Others may connect to customer data, source code, ticketing systems, cloud platforms, or business apps. The risk depends on what the agent can access, how it logs in, how it is shared, and whether it can act without human review. Browser-based discovery can help security teams see more of this activity, but it will depend on which platforms are supported, where the browser extension is deployed, and what data each app makes visible.
