What is the difference between shadow AI agents and ghost agents?
A shadow AI agent was never approved. Someone built it outside the official process, so the organization does not know it exists. A ghost agent was approved once, but its owner has gone, so nobody can say what it is for. Shadow agents are a discovery problem. Ghost agents are an ownership problem.
The two terms get used as if they meant the same thing. They do not, and mixing them up leads to the wrong fix. A discovery sweep will not tell you who owns an agent. A new ownership policy does nothing about an agent you have never found.
Side by side
| Shadow AI agent | Ghost agent | |
|---|---|---|
| Was it approved? | No | Yes, once |
| Does the org know it exists? | No | Yes, somewhere |
| Who knows what it does? | Only the builder | Nobody, any more |
| How it is created | Built outside the process | The owner leaves or changes role |
| The core problem | Discovery | Ownership |
| The first fix | Find it | Name a new owner, or stop it |
How a shadow agent is made
Someone needs something done and the official route is slow. They wire an agent to a tool with their own credentials, and it works. Nobody else is told, because nothing went wrong. The organization now depends on something it has not recorded.
How a ghost agent is made
The agent went through the process. It has an entry somewhere and it was approved. Then the person who ran it moves teams or leaves. The entry is still there, and the agent is still running, but the one person who could answer "what is this for, and is it still needed?" is gone.
The worst case: both
A shadow agent has exactly one person who knows about it. When that person leaves, the agent is both unrecorded and unowned. It has no record to find it by and no owner to ask about it.
Rendering diagram…
Which fix for which problem
For shadow agents, the fix is a list you can trust, and making it easier to register an agent than to build around the process. IBM's Institute for Business Value found that 18% of organizations maintain a current and complete AI inventory. Discovery starts from that list.
For ghost agents, the fix is ownership that does not live in one person's account. In agent.ceo, an agent is a role your organization holds, either one of 16 predefined roles or a custom role you define. It is not a person's login. The organization keeps the role when a person leaves. What you still have to record is who owns it now.
A simple way to check where you stand:
For each agent:
Is it on the organization's list? no -> shadow
Does it have a named owner who is still here? no -> ghost
Was the owner reviewed on a date this quarter? no -> ghost in waiting
For the longer version of the ownership problem, read what is the ghost agent problem?. For the discovery side, read how do I list every agent my organization runs?
FAQ
What is the difference between shadow AI agents and ghost agents?
A shadow AI agent is one the organization never approved or recorded: someone built it outside the official process. A ghost agent was known and approved once, but the person who owned it has left or moved on, so nobody can now say what it is for. Shadow agents are a discovery problem; ghost agents are an ownership problem.
Can a shadow AI agent become a ghost agent?
Yes, and it often does. An agent built outside the process has only one person who knows about it. When that person leaves, the agent is both unrecorded and unowned, which is the hardest case to find and the hardest to decide about.
How do you prevent ghost agents?
Make every agent a role the organization holds, with a named owner recorded next to it, rather than something tied to one person's account. Then review the owner field on a date. When the owner leaves, the agent shows up as unowned instead of quietly running on.
Related: How do you offboard an AI agent? · Agent sprawl and the governance gap · Agent catalog