Paper tests Agent Detector for unsanctioned LLM agents on Windows
Original title: Detecting Shadow AI: Unsanctioned LLM Agents on Enterprise Endpoints: A Taxonomy, an Open Detector and a Controlled Evaluation
On a small controlled bench it caught every synthetic agent in most runs while two behaviour-only rules flagged every twin.
A cs.CR paper argues unsanctioned LLM agents expand shadow IT by leaving scripts, automations and MCP servers that act with user privileges. It proposes nine agent classes and six endpoint footprint layers, and releases Agent Detector, an open Windows tool that ties behaviour to remote-service identity using a catalog of 39 tools and 184 LLM endpoint entries. On one workstation, 12 synthetic agents, 3 AI components and 9 benign workloads were each scanned five times. Behaviour-only rules flagged every behavioural twin; Agent Detector flagged none of those twins and detected every agent in the majority of runs. Attribution lasts only while the DNS cache holds the provider name, about one to five minutes, and an intermittent agent was seen in about one scan in three.
Unconfirmed: Results are from a controlled bench on one workstation, not production deployments.
- A scan costs about 154 ms and notifies the user instead of blocking.
- Shared-CDN connections are attributable only for one to five minutes.
- The authors say the bench is too small to rank detectors.
From the original article
1 min read at arxiv.orgShadow IT, the use of technology that the IT organisation has not approved, is a long-standing governance problem. We argue that autonomous AI agents can make it grow much faster: agents make building tools nearly free, act with their user's privileges, and leave behind scripts, automations and MCP servers that are themselves unsanctioned.
By Jeremy Canale · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.