Key takeaways:
AI agent sprawl means your company is running AI agents it can't count, and The Wall Street Journal reported in 2026 that firms like Lyft, GitLab, and DaVita are already living it.
Nobody snuck these agents in. Employees built them on purpose, for good reasons, faster than anyone set up a way to track them.
When the employee who built an agent leaves, the agent keeps running and keeps its access. Now nobody owns it.
One company's AI agent created 12 automated login accounts over a single weekend. It was built to do that. Nobody knew it could.
The first move is a headcount. Pull a list of every AI agent and automated account that can reach a real system. If you can't build that list in a day, that's your first finding.
AI agent sprawl is the business risk almost no leadership team has measured yet. This isn't a hacking story. It's a counting story, and most companies can't produce the count. Below is what it is, why it happens, and the one thing to do about it this week.
What is AI agent sprawl?
AI agent sprawl is what happens when a company runs more AI agents than it can track, own, or shut off. An AI agent is a piece of software that acts on its own to get work done, like sorting sales leads or answering customer questions after hours. Sprawl sets in when these agents pile up across a company with no single list of what exists and who's responsible.
The Wall Street Journal reported on this in 2026. Companies including Lyft, GitLab, DaVita, and FICO said employees were creating workplace AI agents faster than the business could keep track of them. DaVita said its employees had built more than 10,000. Gartner estimates the average Fortune 500 company could run more than 150,000 AI agents within two years, while only 13% of organizations believe they have adequate governance over them.
Think of it like company keys. If you handed out keys for years and never wrote down who has which one, you don't have a lock problem. You have a records problem. AI agent sprawl is the same gap, at software speed.
Why does AI agent sprawl happen?
Sprawl happens because good employees solve real problems, and building an AI agent got easy. Nobody snuck a bunch of agents in overnight. Each one was set up on purpose, by someone, for a reason that made sense at the time. The tools now let a nontechnical person spin one up in an afternoon, so they do.
Picture Beth in Marketing. She needed help organizing leads, so she built an agent to do it. Sam in Customer Service needed after-hours coverage, so he built one too. Both were the right call. Both got the job done. Neither showed up on any master list, because there wasn't one.
Multiply Beth and Sam across every department and every month, and you get a company running on work no single person can see. The problem isn't bad decisions. It's a hundred reasonable decisions with no one keeping score.
What's the real risk when an AI agent's owner leaves?
The real risk shows up the day the person who built an agent changes jobs. The agent keeps working. It keeps its access too. Now nobody owns it, nobody reviews it, and when you ask who can shut it off, you get a shrug and a sentence like "Beth's been gone since April."
That orphaned agent still has the same reach it had on day one. It can still pull customer records or move money, depending on what it was built to do. A digital worker with real access and no manager is a liability sitting quietly on your systems.
One CIO lived the worst version of this. One of his agents created 12 automated login accounts over a single weekend. The agent was built to do exactly that. He spent a full morning explaining to his audit committee why nobody knew it could. The technology worked as designed. The oversight didn't exist.
How do you get control of AI agent sprawl?
You get control the same way you'd get control of any workforce you'd lost track of. You count it first. Treat every AI agent like a digital employee. It needs a human owner, a defined set of things it's allowed to touch, an off switch, and a reason to still exist. You can't set up any of that until you know what you have.
Start with one list this week. Write down every AI agent and every automated account that can reach a real system. Note who owns each one and what it's allowed to touch. Keep it simple. The goal is visibility, not a perfect audit.
If your team can't build that list in a day, that's not a failure. That's your first finding, and it's the most useful thing you'll learn all quarter. You can't control what you haven't counted. Once the list exists, you can assign owners and shut down what's orphaned.
Frequently asked questions
What's the difference between AI agent sprawl and shadow AI?
Shadow AI usually means employees using outside AI tools that IT doesn't know about, like pasting company data into a public chatbot. AI agent sprawl is broader and often more serious. These are agents the company built on purpose, with real access to real systems, that simply outgrew anyone's ability to track them.
Is AI agent sprawl a security problem or a management problem?
Both, and it starts as a management problem. The agents usually work exactly as designed. The gap is ownership and visibility, not broken code. When you fix the management side by knowing what you have and who's responsible, most of the security risk becomes manageable.
How many AI agents does a typical company have?
More than its leaders think, and often more than IT can count. DaVita reported over 10,000 built by employees. Gartner projects the average Fortune 500 company could run more than 150,000 within two years. The honest answer for most firms today is that they don't have a firm number, which is the point.
Who should own AI agents inside a company?
Every agent needs a named human owner, the same way every employee has a manager. The owner is responsible for what the agent can access, whether it still has a job to do, and shutting it down when it doesn't. Agents without an owner are the ones that become liabilities.
What's the first step for a leadership team?
Ask for a single list of every AI agent and automated account that can touch a real system, along with who owns each one. Give it a week. What comes back, and how hard it was to produce, will tell you exactly how much control you actually have.
The bottom line
AI agent sprawl isn't coming. It's already inside most companies, built one reasonable decision at a time. You haven't been hacked. You're just running digital workers with real access and no one keeping the roster.
More secure AI results in more successful AI. Count your agents now and you'll move faster later, because you'll trust what you've built. Start with the list. Everything else follows from knowing what you have.