The AI Employees Nobody Hired Are Already Inside the Network

Australian businesses are discovering that workers have quietly created autonomous AI agents with persistent access to company systems. It is not merely an Australian problem. It is a preview of the next global cybersecurity crisis.

The most dangerous employee in your organisation may not have a name, an employment contract or even a place on the organisational chart.

It does not sleep. It does not take leave. It can work through the night without supervision, connect to multiple systems simultaneously and process information at a speed no human employee could match. It may also possess permanent access to sensitive company data, customer records, financial information and internal communications.

The disturbing part is that senior management may have no idea it exists.

That is the warning emerging from Australia, where employees are reportedly using generative AI tools to build their own autonomous agents through simple conversational instructions. These agents are then connected to workplace systems and activated without necessarily passing through information technology, cybersecurity, legal or risk teams.

This is shadow IT transformed into something far more powerful.

For years, businesses have struggled with employees downloading unauthorised applications or subscribing to unapproved cloud services. Those tools were risky because they could expose data or bypass established security controls. AI agents introduce an entirely different level of danger because they do not simply store or display information. They can act.

An agent may search files, summarise confidential documents, send messages, update databases, schedule activities, access customer records, generate code or trigger other automated systems. Depending on its permissions, it may be able to perform many of these actions without asking a human for approval each time.

The organisation is no longer dealing with an unapproved piece of software. It is dealing with an unregistered digital worker.

Security systems were designed for people

Okta president and chief operating officer Eric Kelleher has warned that companies are losing visibility over the AI agents operating inside their networks and may not know what information those agents can access.

The problem exposes a fundamental weakness in modern cybersecurity. Most identity and access systems were designed around human behaviour.

A person arrives for work, signs in, performs a defined role and eventually leaves the organisation. Their access can be restricted according to their position, location, device and working hours. They can be required to use a password, fingerprint, facial recognition or another authentication method.

AI agents do not fit neatly into that model.

They have no face to scan and no fingerprint to verify. Instead, they commonly authenticate through service accounts, application programming interface keys and encrypted access tokens. These credentials may be issued once, copied into a script and then left unchanged for months or years.

Sometimes they are stored in plain text. Sometimes nobody remembers where they were placed. In the worst cases, the employee who created the agent leaves the organisation while the agent continues operating with the same access.

This is how convenience becomes infrastructure without anyone making a deliberate decision.

The solution is not simply to give every AI agent a stronger password. Businesses need to rethink how non-human identities are created, monitored and retired.

Every agent should have a documented owner, a defined business purpose and a limited set of permissions. Its credentials should expire, its tokens should be rotated and its actions should be logged. Access should be activated only when required and withdrawn when the task is complete.

An agent created for a three-week reporting project should not retain permanent access to the company’s financial system six months later.

Yet that is exactly the kind of standing access many organisations are now allowing, often without realising it.

Multi-factor authentication is not a magic shield

The warning also challenges a comforting belief held by many executives, that switching on multi-factor authentication automatically solves the identity problem.

It does not.

Multi-factor authentication remains one of the most important protections available to organisations, but not every form provides the same level of security. Codes delivered through text messages or email can still be stolen through phishing, social engineering, session hijacking and other forms of manipulation.

Recent Australian breaches have demonstrated how frequently attackers succeed by targeting identity rather than breaking through a company’s technical perimeter.

Major superannuation funds have faced attacks after weaknesses in authentication controls. Origin Energy disclosed that at least 900,000 customer records had been accessed after an employee login was reportedly used to enter its systems. Qantas introduced stricter limits on employee access after millions of customer records were stolen through an attack involving one of its overseas support centres.

The recurring lesson is that possessing a valid login can be more useful to a criminal than deploying sophisticated malware.

Once an attacker appears to be an authorised user, the critical question becomes what that identity is permitted to see and do.

That question becomes even more urgent with autonomous agents. A compromised human account may be limited by working hours, attention and physical capacity. A compromised agent can search, collect and transfer information continuously, at machine speed.

Companies should continue moving towards phishing-resistant authentication for human users, including passkeys, biometrics and hardware-backed security methods. At the same time, they must develop equivalent controls for machine identities.

For AI agents, that means short-lived credentials, narrowly defined permissions, secure secrets management, continuous monitoring and automatic expiration. It also means giving security teams the ability to deactivate an agent immediately when suspicious behaviour is detected.

Banning AI will only drive it underground

Some organisations will respond to this risk by attempting to prohibit employees from creating or using AI agents.

That is unlikely to work.

Workers are adopting these tools because they can automate repetitive tasks, accelerate analysis and remove administrative burdens. When official systems are slow or inadequate, employees will look for alternatives. A blanket ban may simply ensure that those alternatives are used secretly.

The more effective approach is to create a controlled path for experimentation.

Organisations should provide approved platforms, secure development environments and clear processes for registering new agents. Employees should be taught that connecting an AI tool to company data is not the same as asking a public chatbot to rewrite a paragraph.

An agent with access to email, internal documents and customer systems is part of the organisation’s operational environment. It should be assessed accordingly.

This does not require months of bureaucracy for every small automation. It requires proportionate governance. A low-risk agent that organises publicly available information does not need the same scrutiny as one that can retrieve health records, approve payments or modify production systems.

The essential requirement is visibility. Security teams cannot protect what they cannot see.

Every organisation adopting AI should maintain an inventory of its agents. That inventory should identify who created each agent, who remains responsible for it, which systems it can access, what actions it can perform and when its authority will expire.

There should also be a reliable kill switch.

Data sovereignty adds another layer

Kelleher has also raised concerns about Chinese-owned companies, including TikTok and Alibaba, exploring data centre development in Australia.

The issue should not be reduced to nationality alone. Any foreign technology provider handling sensitive or sovereign data should be examined according to ownership, jurisdiction, legal obligations, administrative access and government influence.

A server located inside a country’s borders does not automatically guarantee that the information stored on it is beyond foreign access.

Governments and businesses need to understand who can administer the infrastructure, where encryption keys are held, which laws apply to the parent company and whether overseas personnel can access local systems.

These questions are becoming more important as AI agents move information between cloud platforms, software providers and data centres. A company may believe its information remains within an approved environment while an autonomous process quietly sends data to an external model or service.

Data residency is not enough. Organisations need data visibility.

The question every board should ask

The arrival of autonomous AI agents requires a change in how businesses think about identity.

An AI agent is not merely a feature inside a software platform. It is an actor within the network. It has credentials, permissions and the ability to perform tasks. In some cases, it may have broader access than the employee who created it.

That makes agent governance a board-level issue, not simply a technical problem for the information technology department.

Executives should be asking how many non-human identities operate inside the organisation, who owns them, what information they can access, how their credentials are protected and when their permissions expire.

Any company unable to answer those questions should assume that unauthorised agents may already be operating.

Australia’s shadow AI warning is not an isolated local concern. Businesses around the world are encouraging employees to experiment with generative AI while their security controls remain designed for an earlier era.

The digital workforce is arriving before the policies, systems and accountability structures required to manage it.

The greatest danger is not that AI agents will suddenly become malicious. It is that organisations will give them extensive access, leave them running indefinitely and fail to notice when someone else takes control.

The AI employee nobody hired may already be inside the building.

The question is whether anyone is supervising it.