Canale, Jeremy, Soulis, Fabien · Nov 9, 2026
arXiv cs.AI: Canale and Soulis argue behavior rules cannot detect Shadow AI alone
Markdown · JSON · Original source
Jeremy Canale and Fabien Soulis argue that autonomous could accelerate Shadow IT: they make building tools nearly free, act with users’ privileges, and leave behind unsanctioned scripts, automations and MCP servers. Their compounding model says Shadow IT grows exponentially under its assumptions when artifacts reproduce faster than the organization retires them. The authors argue that process and connection structure alone cannot distinguish an agent from its behavioral twin: the same program communicating with a non-AI service. They present Agent Detector, an open-source Windows detector that connects the identity of a remote service with configuration, installation and execution history. In a controlled bench with 12 synthetic agents, 3 AI components and 9 benign workloads, repeated 5 times on one workstation, two behavioral rules flagged every behavioral twin. Agent Detector flagged none and detected every agent in a majority of runs. The authors caution that the bench is too small to rank detectors. They also describe temporal limits: a provider behind a shared content-delivery network is attributable only while its name remains in the DNS cache, one to five minutes, and an intermittent agent was seen by about one scan in three. Their conclusion is bounded: unsanctioned agents can be partly detected, but not by behavior alone.
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
cs.AI · Article
Source details
Original source date: Nov 9, 2026 (2026-11-09).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-12T08:47:31.906Z. First observed: 2026-11-10T08:39:36.290Z. Retrieved: 2026-11-12T08:46:50.564Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
The evaluation used 12 synthetic agents, 3 AI components and 9 benign workloads, repeated 5 times on one workstation; the authors say it is too small to rank detectors. A provider behind a shared content-delivery network is attributable only while the DNS cache holds the provider's name, reported as one to five minutes; an intermittent agent was seen by about one scan in three.
Open question
How would Agent Detector perform on a larger evaluation bench with more varied agents and workloads?
Source-stated
Canale and Soulis argue that autonomous AI agents could accelerate Shadow IT because they make building tools nearly free, use their users’ privileges and create unsanctioned artifacts.
agents make building tools nearly free, act with their user's privileges, and leave behind scripts, automations and MCP servers that are themselves unsanctioned.
Source-stated
The authors’ model says Shadow IT grows exponentially under its assumptions when agentic artifacts reproduce faster than the organization retires them.
under its assumptions, shadow IT grows exponentially once agentic artifacts reproduce faster than the organisation retires them
Source-stated
The authors argue that process and connection structure alone cannot distinguish an agent from the same program communicating with a non-AI service.
rules based only on the structure of processes and connections cannot separate an agent from its behavioural twin, the same program talking to a non-AI service.
Source-stated
On the controlled bench, two behavioral rules flagged every behavioral twin; Agent Detector flagged none and detected every agent in a majority of runs.
two behavioural rules flagged every behavioural twin, while Agent Detector flagged none and detected every agent in the majority of runs.
Source-stated
The authors say the bench is too small to rank detectors and describe temporal limits on detection.
The bench is too small to rank detectors; it maps what each kind of evidence can see
Source and contributor context
Canale, Jeremy, Soulis, Fabien · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
AI agent
An AI system that chooses and carries out actions toward a goal, often using software tools.
Agentic AI
AI systems that plan and carry out a series of steps toward a goal, often by using other software, rather than giving one answer.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: f4747dbc-3a6e-4fa7-8458-40e02a9ea605.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-12T08:47:31.906Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 8916043e93f04171de98bc2aa616ab88f9de22580605b55251bed768e3283ffe. Source text hash: 108451074c4ff25eae2f87fb17a47d9e04082454713f89e312cc075e034114cd.
Revision and source-check history
Version 1 · 2026-11-12T08:47:31.906Z
arXiv cs.AI: Canale and Soulis argue behavior rules cannot detect Shadow AI alone
Jeremy Canale and Fabien Soulis argue that autonomous could accelerate Shadow IT: they make building tools nearly free, act with users’ privileges, and leave behind unsanctioned scripts, automations and MCP servers. Their compounding model says Shadow IT grows exponentially under its assumptions when artifacts reproduce faster than the organization retires them. The authors argue that process and connection structure alone cannot distinguish an agent from its behavioral twin: the same program communicating with a non-AI service. They present Agent Detector, an open-source Windows detector that connects the identity of a remote service with configuration, installation and execution history. In a controlled bench with 12 synthetic agents, 3 AI components and 9 benign workloads, repeated 5 times on one workstation, two behavioral rules flagged every behavioral twin. Agent Detector flagged none and detected every agent in a majority of runs. The authors caution that the bench is too small to rank detectors. They also describe temporal limits: a provider behind a shared content-delivery network is attributable only while its name remains in the DNS cache, one to five minutes, and an intermittent agent was seen by about one scan in three. Their conclusion is bounded: unsanctioned agents can be partly detected, but not by behavior alone.
Original source
cs.AI · Article
Source details
Original source date: Nov 9, 2026 (2026-11-09).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-12T08:47:31.906Z. First observed: 2026-11-10T08:39:36.290Z. Retrieved: 2026-11-12T08:46:50.564Z.
Limits
The evaluation used 12 synthetic agents, 3 AI components and 9 benign workloads, repeated 5 times on one workstation; the authors say it is too small to rank detectors. A provider behind a shared content-delivery network is attributable only while the DNS cache holds the provider's name, reported as one to five minutes; an intermittent agent was seen by about one scan in three.
Open question
How would Agent Detector perform on a larger evaluation bench with more varied agents and workloads?
Source-stated
Canale and Soulis argue that autonomous AI agents could accelerate Shadow IT because they make building tools nearly free, use their users’ privileges and create unsanctioned artifacts.
agents make building tools nearly free, act with their user's privileges, and leave behind scripts, automations and MCP servers that are themselves unsanctioned.
Source-stated
The authors’ model says Shadow IT grows exponentially under its assumptions when agentic artifacts reproduce faster than the organization retires them.
under its assumptions, shadow IT grows exponentially once agentic artifacts reproduce faster than the organisation retires them
Source-stated
The authors argue that process and connection structure alone cannot distinguish an agent from the same program communicating with a non-AI service.
rules based only on the structure of processes and connections cannot separate an agent from its behavioural twin, the same program talking to a non-AI service.
Source-stated
On the controlled bench, two behavioral rules flagged every behavioral twin; Agent Detector flagged none and detected every agent in a majority of runs.
two behavioural rules flagged every behavioural twin, while Agent Detector flagged none and detected every agent in the majority of runs.
Source-stated
The authors say the bench is too small to rank detectors and describe temporal limits on detection.
The bench is too small to rank detectors; it maps what each kind of evidence can see
Source and contributor context
Canale, Jeremy, Soulis, Fabien · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
AI agent
An AI system that chooses and carries out actions toward a goal, often using software tools.
Agentic AI
AI systems that plan and carry out a series of steps toward a goal, often by using other software, rather than giving one answer.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: f4747dbc-3a6e-4fa7-8458-40e02a9ea605.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-12T08:47:31.906Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 8916043e93f04171de98bc2aa616ab88f9de22580605b55251bed768e3283ffe. Source text hash: 108451074c4ff25eae2f87fb17a47d9e04082454713f89e312cc075e034114cd.
uncertain · 2026-11-12T08:47:31.906Z · anthropic/claude-opus-5.5
Publication: f4747dbc-3a6e-4fa7-8458-40e02a9ea605
attribution — pass: The reading correctly attributes the arguments, model, detector and results to the arXiv paper's authors, Jeremy Canale and Fabien Soulis. It keeps the compounding model and the detection claims framed as the authors' arguments and findings.
Authors:Jeremy Canale, Fabien Soulis
summary — uncertain: The summary is faithful and keeps the authors' bounded conclusion, but it never defines the central term Shadow IT, which the source defines as technology the IT organisation has not approved. A general reader may also miss that behavioural rules flagging every behavioural twin means false alarms on non-AI programs. MCP servers are left unexplained. Smallest repair: add the source's one-clause definition of Shadow IT and state plainly that the twins were non-AI false positives. Optional: mention that the detector notifies users, who must acknowledge a notice, rather than blocking.
Shadow IT, the use of technology that the IT organisation has not approved, is a long-standing governance problem.
date — pass: The originalPublished date of 2026-11-09 matches the v1 submission date shown on the arXiv page. The feed date of 2026-11-10 is correctly not used.
[Submitted on 9 Nov 2026]
support — pass: All claims and limitations match the abstract: the growth argument, the conditional exponential model, the behavioural twin argument, the bench composition and results, the bench-size caveat, and the DNS-cache and intermittency limits. The question about a larger bench follows directly from the authors' own caveat and does not lead the reader. No unsupported benefits or costs are implied.
two behavioural rules flagged every behavioural twin, while Agent Detector flagged none and detected every agent in the majority of runs.
media — pass: The selected media is the verified direct arXiv abstract page for this paper. This is the most direct access to the source.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
An AI system that chooses and carries out actions toward a goal, often using software tools.
Definition referenceAI systems that plan and carry out a series of steps toward a goal, often by using other software, rather than giving one answer.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivAn AI system that chooses and carries out actions toward a goal, often using software tools.
Definition referenceAI systems that plan and carry out a series of steps toward a goal, often by using other software, rather than giving one answer.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXiv