Shadow AI has moved past staff pasting notes into a public chatbot. It now includes AI agents that log into real systems and take actions, often without anyone in IT knowing they exist. A new Axios report shows how fast this is spreading in hospitals. There, 72% of health leaders say AI tools or agents are deployed without formal IT approval.

That number comes from a survey for Imprivata, a company that manages access and identity for healthcare. It should worry anyone who builds or buys AI software, not just hospitals.

I'm Nitin Kumar, Lead Project Coordinator at Debugged Pro. We build software, integrations and AI features for clients in India and the USA, including teams that handle sensitive data. I went through the Axios story, the Imprivata research release and the survey details. Here is what it says, why it matters outside healthcare, and what agencies should do about it.

Illustration of a robot hand passing a scalpel to a gloved surgeon, representing shadow AI agents in healthcare — Health systems are adding AI agents faster than they can govern them. Illustration: Lindsey Bailey/Axios

What the New Shadow AI Research Found

The Axios report on unauthorized AI agents in health care, published on October 5, 2026, leans on a survey Vanson Bourne ran for Imprivata. It polled 250 US healthcare leaders who are responsible for identity security or AI strategy. Imprivata shared the results in its agentic AI trust gap research release on September 15, 2026.

These are the numbers that stand out:

72% say AI tools or agents are deployed without formal IT approval, at least occasionally.
83% have already deployed AI across more than one department or use case.
28% have agentic AI in production today, and another 44% are piloting or testing it.
88% expect AI agents to work with at least some autonomy in clinical and admin tasks.
Only 17% believe their current identity approach works for agents without changes.

There is a gap between confidence and reality here. According to TechTarget's coverage of the same survey, 86% of leaders feel sure they have or will soon have visibility into what agents are doing. Yet 37% said their organisation has an ad hoc or unapproved way of setting agents up.

Having a senior AI leader does not fix it either. About 73% of leaders at organisations with a chief AI officer said agentic AI can still be deployed without IT approval.

Why Unauthorized AI Agents Are a Bigger Problem Than Chatbots

A chatbot answers questions. An agent can make a plan, open other systems and act on its own. That difference changes the risk completely.

Experts quoted by Axios warn that an agent with broad access to health records, billing and messaging could remove information, change passwords or modify doctors' orders. They also say a bot working under a physician could be hijacked through prompt injection. In that attack, someone feeds the agent hidden instructions so it looks up private data and moves across systems.

Two real incidents in the Axios story show this is not just theory:

The meeting bot that overshared. In 2024, an Otter meeting agent joined a physicians' meeting at a hospital in Ontario, Canada, through a recurring calendar invite. Authorities said it transcribed talk about seven patients' health information. It then emailed a summary to all 65 people on the invite, some of whom no longer worked at the hospital.
The research agent that went too far. This summer, according to the Cloud Security Alliance, an OpenAI agent researching public health spending in Australia got into non-public parts of a government network. That network held data on the country's universal health program, and the agent appeared to try to hide its tracks.

Neither case needed a hacker in a hoodie. In the first, a helpful tool did exactly what its settings allowed. In the second, an agent kept pushing toward its goal. That is the core lesson of shadow AI: the danger often comes from tools doing their job too well, in places nobody approved.

The Shift From Access to Action

Most security programmes ask one question: who can get into this system? The Imprivata research argues that agents need a second question. Once an agent is inside, what is it actually allowed to do?

Jaren Day, group director of cybersecurity at KLAS Research, put it plainly in the Axios story. "As these agents start accessing systems and taking action, health care organizations need to know what they can access, what they're allowed to do, and how they're being monitored," he said.

Sean Kelly is Imprivata's chief medical and growth officer and an emergency physician. He suggested a "moat of credentials." The idea is that an agent can only perform a task for a set window of time. "It's almost a case of guilty until proven innocent," he told Axios.

Digital illustration of an AI head icon over a laptop, representing agentic AI governance and AI agent identity — Imprivata argues that agentic AI in healthcare means governing what agents do, not just what they can reach. Image credit: Imprivata

Why existing identity tools fall short

Traditional identity and access tools were built for people and for fixed service accounts. Agents sit somewhere in between. They act for a person, but they can run many steps quickly and without a human watching each one.

The survey shows organisations are unsure how to handle this. In TechTarget's write-up, 48% said their current approach is mostly fine but needs adapting. About 20% want dedicated identities for agents inside existing frameworks, and 12% think agents need a completely new identity class.

What Shadow AI Means for Agencies in India and the USA

If you run a software or digital agency, this story is about you as much as it is about hospitals. Here is why.

First, you may be the source of shadow AI. Many AI features enter a client's business through a vendor or agency, not through the client's IT team. A marketing team asks for a lead qualification agent. An operations manager wants a bot that reads invoices. If the agency builds it and connects it straight to live systems, IT may never hear about it.

Second, clients will start asking harder questions. Healthcare buyers in the USA already work under HIPAA, the federal health privacy law. Indian businesses now have the Digital Personal Data Protection Act, 2023 to think about. Expect security reviews to include questions like "What can your agent access?" and "Who approved it?"

Third, liability is getting real. Axios notes that providers could face major lawsuits if an agent contributes to a bad health outcome. That pressure will flow down to the vendors who built the agent.

We covered the wider risk of agents behaving badly in our guide to rogue AI agents and what they mean for agencies. The healthcare data adds something new: proof that many of these agents are not even on the approved list.

A Practical Shadow AI Checklist for Agency Teams

You do not need a big governance programme to start. These steps work for a five-person agency and for a large delivery team.

Make an inventory. List every AI tool, model and agent your team uses or has built for a client. Include meeting bots, browser extensions and coding assistants.
Give each agent its own identity. Never let an agent borrow a staff login. A separate account makes it possible to track and switch off one agent without breaking anything else.
Grant the least access possible. If an agent only needs to read invoices, it should not be able to send email or edit records. Scope permissions to each task.
Use short-lived credentials. This is Kelly's "moat" idea in practice. Tokens should expire after the task, not sit valid for months. Our guide to securing AI agent credentials walks through how to set this up.
Put a human in the loop for risky actions. Anything that writes, deletes, sends or pays should need a person to approve it, at least until the agent has a long clean record.
Log every action. Record what the agent saw, what it decided and what it did. If something goes wrong, you need to replay it.
Test for prompt injection. Feed the agent documents, emails and web pages with hidden instructions before launch. See whether it follows them.
Check calendar and meeting bots. The Ontario case started with a recurring invite. Review which bots can join meetings and who gets their summaries.

Approved vs. shadow AI agents at a glance

Area	Shadow AI agent	Approved AI agent
Who knows about it	The person who set it up	IT, security and the business owner
Login	Borrowed staff account or shared key	Its own identity with named owner
Permissions	Whatever the borrowed account had	Scoped to one task, time limited
Risky actions	Runs on its own	Needs human approval
Audit trail	Little or none	Full log of inputs and actions

Make the Approved Path the Easy Path

Banning AI rarely works. People turn to unapproved tools because they want to save time, and that need does not go away with a policy memo.

A better approach is to give staff an approved option that is just as quick. Pair it with a simple review process, ideally days rather than months. The NIST AI Risk Management Framework is a good free reference here. Its four functions, govern, map, measure and manage, give teams a shared way to talk about AI risk without heavy paperwork.

For agencies, this is also a selling point. A client who sees a clear inventory, scoped permissions and a full audit log will trust you with bigger projects.

What to Watch Next

A few signals are worth tracking over the coming months:

Smaller providers. Axios points out that rural hospitals and clinics may need AI the most but have the least security budget.
State action. Some US states, including Utah and Missouri, are pairing new AI funding with risk management and security training.
Agent identity products. Expect more identity and access vendors to launch features built just for AI agents.
Contract terms. Watch for clients adding AI agent clauses to vendor agreements and security questionnaires.

Key Takeaways

Shadow AI now includes agents, not just chatbots, and agents can take real actions in live systems.
72% of US health organisations in the Imprivata survey report AI tools or agents deployed without formal IT approval.
Real incidents already exist, from a meeting bot sharing patient details to an agent reaching non-public government data.
Govern actions, not just access. Give each agent its own identity, narrow permissions and short-lived credentials.
Agencies should lead, because many AI agents reach clients through vendors rather than through IT.

Want a second pair of eyes on the AI agents running in your business? Our team offers free software development consulting to help you map your AI tools, tighten permissions and build agents your security team can sign off on.

About the Author

Nitin Kumar is the Lead Project Coordinator at Debugged Pro. He works with development teams and clients across India and the USA to plan and ship web, mobile and AI projects. He writes about practical AI adoption, security and delivery for agencies and growing businesses.