Topic
Applications and services running outside an organisation's provisioning, inventory and review processes.
ICO reprimanded the Metropolitan Police for putting data on 179 people into Auror, a platform that had no data protection impact assessment. The force has tightened procedures since, but the regulator says it still is not ensuring that only approved tools are used.
Reality
Fabian Hedin, Lovable's CTO, said two-thirds of the Fortune 500 use the tool because staff found it themselves, and put current revenue at $600m. The permissions work starts after the apps are running.
Reality
Engadget says SpaceXAI's agent signs into Gmail, LinkedIn and Salesforce and acts for the user, with eligibility running through six individual paid tiers. The only brake described is a human-approval setting.
Reality
The only public count of internet-exposed MCP servers is fourteen months old, so a new open-source scanner fingerprints them by protocol handshake and reports which ones answer a caller holding no credentials.
Reality
At Dreamforce, Anton Osika said the argument over letting non-engineers ship software is finished. His evidence is automatic vulnerability scanning on every change and connector rules that limit data by who is logged in.
Reality
Two security advisers in Google Cloud's Office of the CISO argue that prohibiting AI agents drives staff into running their own, and they put identity and access management ahead of every other control.
Reality
Dayne Oram told an employment tribunal he believes a 2023 return-to-office petition became the basis of an internal watch list. Rockstar says the dismissals followed the sharing of confidential company information.
Reality
A New Stack piece argues the new shadow IT gets provisioned inside your own cloud account by an agent working for a helpful engineer, which means the OAuth grants and expense reports your playbook watches never fire.
Reality
A dev.to writeup describes three unsanctioned apps built on Lovable, Replit and Vercel that no inventory system ever held, and the discovery it recommends only sees assets carrying one of your identifiers.
Reality