Shadow AI Agents: Finding and Governing the Third-Party AI Your SSO Can't See (2026 State of Agent Security)

---
title: OAuth Application Consent Granted to Third-Party Application
id: 3f7a2c91-4d58-4e6b-b1a2-9c8e7d6f5a4b
status: experimental
description: Detects user or admin consent grants to applications in Entra ID. Ungoverned AI assistants and embedded third-party AI features frequently establish access via user consent, bypassing SSO governance entirely.
references:
  - https://thehackernews.com/2026/10/the-third-party-agent-problem-why.html
  - https://attack.mitre.org/techniques/T1528/
  - https://attack.mitre.org/techniques/T1550/001/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.persistence
  - attack.credential_access
  - attack.t1528
  - attack.t1550.001
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName:
      - 'Consent to application'
      - 'Add OAuth2PermissionGrant'
      - 'Add service principal'
      - 'Add app role assignment to service principal'
  filter_known_critical:
    # Suppress consents to sanctioned, reviewed first-party integrations
    operationName: 'Add service principal'
    resultType: '0'
  condition: selection
falsepositives:
  - Legitimate application onboarding through IT-approved procurement
  - Admin consent for sanctioned enterprise applications
level: medium
---
title: Local AI Agent Runtime or MCP Server Execution
id: 8b1e4d26-7f3a-4c59-9e2d-1a5b6c7d8e9f
status: experimental
description: Detects execution of local AI agent frameworks and Model Context Protocol (MCP) servers via node/npx or Python. These runtimes operate outside identity governance, often hold API keys in plaintext configs, and provide tool-use access to local resources.
references:
  - https://thehackernews.com/2026/10/the-third-party-agent-problem-why.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\node.exe'
      - '\npx.cmd'
      - '\python.exe'
      - '\pythonw.exe'
      - '\uv.exe'
      - '\uvx.exe'
      - '\bun.exe'
  selection_cli:
    CommandLine|contains:
      - 'modelcontextprotocol'
      - 'mcp-server'
      - 'mcp_server'
      - '@anthropic'
      - 'langchain'
      - 'autogen'
      - 'crewai'
      - 'openai-agents'
      - 'claude_desktop_config'
  filter_dev_paths:
    # Reduce noise from reviewed developer workstations; remove after baseline
    Image|startswith:
      - 'C:\Program Files\ApprovedTooling\'
  condition: selection_img and selection_cli and not 1 of filter_*
falsepositives:
  - Developer workstations with sanctioned AI tooling
  - QA/automation pipelines using agent frameworks
level: medium
---
title: Suspicious OAuth Grant with High-Risk Mail or File Scopes
id: 5c9d3e17-2a84-4b6f-a1d3-7e5f9c2b4a68
status: experimental
description: Detects consent grants requesting broad data access scopes commonly abused for silent data exfiltration by third-party AI assistants. Combination of offline_access with Mail/Files/Sites read scopes enables persistent mailbox and document access without further user interaction.
references:
  - https://thehackernews.com/2026/10/the-third-party-agent-problem-why.html
  - https://attack.mitre.org/techniques/T1528/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.collection
  - attack.persistence
  - attack.t1528
  - attack.t1114
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName: 'Consent to application'
    modifiedProperties|contains:
      - 'Mail.Read'
      - 'Mail.ReadWrite'
      - 'Files.Read.All'
      - 'Files.ReadWrite.All'
      - 'Sites.Read.All'
      - 'full_access_as_app'
  selection_persist:
    modifiedProperties|contains:
      - 'offline_access'
  condition: selection and selection_persist
falsepositives:
  - Approved backup, eDiscovery, or CRM synchronization tooling
level: high

// Hunt 1: New OAuth consent grants and service principals (potential ungoverned AI agents)
let Lookback = 14d;
let HighRiskScopes = dynamic(["Mail.Read","Files.Read.All","Sites.Read.All","offline_access","full_access_as_app","Chat.Read"]);
AuditLogs
| where TimeGenerated > ago(Lookback)
| where OperationName in~ ("Consent to application","Add OAuth2PermissionGrant","Add service principal")
| where Result == "success"
| mv-expand TargetResources
| mv-expand TargetResources.modifiedProperties
| extend PropName = tostring(TargetResources_modifiedProperties.displayName),
         NewValue = tostring(TargetResources_modifiedProperties.newValue)
| where PropName =~ "ServicePrincipalNames" or NewValue has_any (HighRiskScopes)
| extend AppDisplayName = tostring(TargetResources.displayName),
         ConsentingUser = tostring(InitiatedBy.user.userPrincipalName)
| summarize FirstSeen=min(TimeGenerated), Scopes=make_set(NewValue)
  by AppDisplayName, ConsentingUser, OperationName, CorrelationId
| order by FirstSeen desc;

// Hunt 2: Local agent runtime execution and connections to AI model endpoints
let AIEndpoints = dynamic(["api.openai.com","api.anthropic.com","generativelanguage.googleapis.com","api.cohere.com","openrouter.ai","registry.modelcontextprotocol.io"]);
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ ("node.exe","npx.cmd","python.exe","uv.exe","uvx.exe","bun.exe")
| where ProcessCommandLine has_any ("modelcontextprotocol","mcp-server","mcp_server","langchain","autogen","crewai","claude_desktop_config")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl has_any (AIEndpoints)
    | project DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, TimeGenerated2=TimeGenerated
) on DeviceName, $left.FileName == $right.InitiatingProcessFileName
| summarize arg_max(TimeGenerated, *) by DeviceName, ProcessCommandLine
| order by TimeGenerated desc

-- Hunt: Third-Party AI Agent Runtime and MCP Configuration Discovery
-- Identifies running agent processes and reads MCP/agent config files
-- that typically contain API keys and server definitions outside IdP governance.

SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)modelcontextprotocol|mcp[-_]server|langchain|autogen|crewai|openai-agents|claude_desktop'
   OR Exe =~ '(?i)(node|npx|python|uvx?|bun)\.exe$'
      AND CommandLine =~ '(?i)mcp|agent'

-- Hunt: Agent and MCP configuration files containing API keys / server definitions
SELECT FullPath, Size, Mtime, Btime,
       read_file(filename=FullPath, length=8192) AS ConfigSnippet
FROM glob(globs=[
  'C:/Users/*/AppData/Roaming/Claude/claude_desktop_config.json',
  'C:/Users/*/.cursor/mcp.json',
  'C:/Users/*/.codeium/windsurf/mcp_config.json',
  'C:/Users/*/.config/*/mcp.json',
  'C:/Users/*/.aws/credentials',
  'C:/Users/*/.openai/*',
  '/home/*/.config/Claude/claude_desktop_config.json',
  '/home/*/.cursor/mcp.json',
  '/Users/*/Library/Application Support/Claude/claude_desktop_config.json'
])
WHERE ConfigSnippet =~ '(?i)api[_-]?key|token|mcpServers|command'

# Requires: Microsoft.Graph PowerShell SDK, Application.Read.All + Directory.Read.All (audit) or Directory.ReadWrite.All (remediate)
# Connect-MgGraph -Scopes "Application.Read.All","Directory.Read.All"

$ReportPath = ".\ThirdPartyAgentInventory_$(Get-Date -Format 'yyyyMMdd').csv"
$HighRiskScopes = @('Mail.Read','Mail.ReadWrite','Mail.Send','Files.Read.All','Files.ReadWrite.All',
                    'Sites.Read.All','Chat.Read','ChannelMessage.Read.All','full_access_as_app','offline_access')

# 1. Enumerate all delegated OAuth permission grants (user/admin consent)
Write-Host "[*] Enumerating OAuth2 permission grants..." -ForegroundColor Cyan
$grants = Get-MgOauth2PermissionGrant -All
$results = foreach ($g in $grants) {
    $clientSp  = Get-MgServicePrincipal -ServicePrincipalId $g.ClientId -ErrorAction SilentlyContinue
    $resourceSp = Get-MgServicePrincipal -ServicePrincipalId $g.ResourceId -ErrorAction SilentlyContinue
    $scopes = $g.Scope -split ' '
    $risky = $scopes | Where-Object { $_ -in $HighRiskScopes }
    [PSCustomObject]@{
        AppName        = $clientSp.DisplayName
        AppId          = $clientSp.AppId
        PublisherVerified = $clientSp.VerifiedPublisher.IsVerified
        ConsentType    = $g.ConsentType   # 'AllPrincipals' = admin-wide; 'Principal' = single user
        ResourceApi    = $resourceSp.DisplayName
        Scopes         = ($scopes -join ';')
        HighRiskScopes = ($risky -join ';')
        RiskFlag       = if ($risky.Count -gt 0 -and -not $clientSp.VerifiedPublisher.IsVerified) { 'REVIEW' } else { 'OK' }
    }
}

# 2. Enumerate non-Microsoft service principals (third-party apps registered in tenant)
Write-Host "[*] Enumerating third-party service principals..." -ForegroundColor Cyan
$thirdParty = Get-MgServicePrincipal -All -Filter "servicePrincipalType eq 'Application'" |
    Where-Object { $_.AppOwnerOrganizationId -ne 'f8cdef31-a31e-4b4a-93e4-5f571e91255a' } |  # Microsoft tenant ID
    Select-Object DisplayName, AppId, CreatedDateTime, AccountEnabled,
                  @{N='PublisherVerified';E={$_.VerifiedPublisher.IsVerified}}

$results | Export-Csv "$ReportPath" -NoTypeInformation
$thirdParty | Export-Csv "ThirdPartyServicePrincipals_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
$results | Where-Object RiskFlag -eq 'REVIEW' | Format-Table -AutoSize
Write-Host "[*] Inventory complete. Review flagged grants in: $ReportPath" -ForegroundColor Green

# 3. REMEDIATE (change-control required): revoke a confirmed malicious/unauthorized grant
# Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId "<GrantId>"
# Update-MgServicePrincipal -ServicePrincipalId "<SpId>" -AccountEnabled:$false