Employee-Built AI Agents Pose New Risks and Opportunities

A growing number of employees are creating their own AI agents to automate tasks, often without IT approval. A recent survey by Howdy.com found that 16% of knowledge workers have started building their own agents, with many driven by excitement over new automation possibilities.

While most deactivated agents stem from performance issues (inconsistent outputs or failures), a concerning 7% had to be shut down for going “rogue” – highlighting potential security and compliance risks when AI development operates outside established IT governance.

The Citizen AI Trend

This phenomenon reflects broader trends in citizen AI, where business users are empowered to build their own solutions. As Luis Mesas of Sngular notes, employees will inevitably create agents regardless of formal policies due to increasing demand for automation and limited engineering resources.

But the risks extend beyond simple failures: when these shadow agents access sensitive data or integrate with core systems, they can create new attack vectors and compliance gaps that IT may be unaware of. As Mesas warns, “The bigger concern is not that an employee creates an agent, but what happens when that agent starts connecting to company systems and data without the same controls.”

A Balanced Approach

Rather than outright bans, experts recommend establishing clear guidelines while encouraging responsible experimentation. Andy Sen of AppDirect advocates for “digital playgrounds” where employees can innovate freely under IT oversight – similar to how companies manage shadow IT today.

The key takeaway is that AI governance needs to evolve beyond traditional software development models to address this new wave of employee-led innovation, ensuring both productivity gains and security resilience.