Punchcard's Jenkins: 3 in 10 staff run unsanctioned AI agents

Jenkins frames agentic shadow AI as a step change from the earlier era of unsanctioned chatbots. The Microsoft figure of nearly three in 10 employees, alongside Adobe's finding that nearly half of workers who receive agentic AI training build their own custom agents, suggests the practice is spreading as tools make it easy to build powerful agents before risks are understood. He notes that many employees are not aware of the risks they create, not out of carelessness but because the tools are remarkably easy to use.

The governance gap is stark. A Deloitte survey of 3,235 IT and business leaders found only 21% of organizations report mature governance models for agentic AI risk, while more than half of organizations surveyed by the Cloud Security Alliance this year have experienced agents exceeding intended permissions. Jenkins argues this means most organizations deploying agentic AI, sanctioned or not, have already seen it behave in ways they did not intend.

Beyond data exposure, Jenkins points to a longer-term loss: institutional knowledge embedded in employee-built agents that is neither visible nor documented. He calls for shared build environments with controls, and for data, content and business activity to be legible to AI systems so employees stop finding workarounds. He expects the AI-native transformation to unfold over roughly two years, and urges organizations to start now so knowledge and workflows stay with the business.