Bring Your Own Agent: Your Employees' Assistants Are Already Logged In
Employees are linking personal AI agents to corporate apps through OAuth, passwords, and API tokens, creating unmanaged identity risk.
Personal AI agents including Meta's Muse, OpenAI's Dots, xAI's GrokBot, Instinct, and open-source OpenClaw are being connected to workplace systems by employees, often without IT tickets. Access commonly comes through OAuth consent to Google Workspace, Microsoft 365, or Slack, saved browser passwords, API keys and personal access tokens, or local agents on employee laptops. Vendors are adding controls only for managed corporate deployments, so personal agents do not appear in admin consoles. Instinct, a text-based agent, raised $1 billion at a $10 billion valuation and has drawn privacy concerns.
46