Nudge Security uses two complementary discovery channels to find agents created across popular agentic AI platforms. Connected apps enable API-based agent discovery while our browser extension goes beyond API limitations, passively observing when employees create or view agents in agentic platforms through the browser.
The agentic platforms employees use beyond the purview of IT are where real shadow AI lives. Nudge Security's browser extension passively discovers agents on popular agentic platforms the moment they're created or listed, without intercepting traffic or monitoring everything employees type.
Nudge Security automatically evaluates every discovered agent for risk signals and surfaces findings your team can act on right away.
Once agents are in inventory, Nudge Security gives your security team the workflows to act—without creating friction for the people building and deploying them.
Common questions about Nudge Security's AIÂ agent discovery feature
Nudge Security automatically evaluates every agent for risk signals including publicly accessible agents, agents with excessive or destructive permissions, hardcoded credentials in agent instructions, unauthenticated MCP connections, integrations with high-risk apps, and agents whose creators have left the organization. Every flag maps to a specific, actionable finding so your team knows exactly what to do next.
If your organization already deploys the Nudge Security browser extension for SaaS discovery, browser-based agent discovery is included—no additional rollout required. For organizations that haven't deployed the extension yet, that's the one step needed to enable browser-based coverage.
Nudge Security uses two discovery channels in parallel. API-based discovery runs through connected apps for platforms that expose a public API, continuously pulling agent data including name, creator, creation date, status, and metadata. Browser-based discovery runs through the Nudge Security browser extension for platforms without APIs, passively observing when employees create or view agents and adding them to inventory automatically. Together, the two channels cover the platforms where agents are actually being built—including the ones employees adopt without IT involvement.
Nudge Security identifies the person who built each agent and, where possible, matches them to your directory. From there, you can assign a technical contact as the ongoing owner—who may or may not be the original creator—and send a nudge to confirm intent, ask for a business justification, or request remediation. Nudge responses populate the agent's intent field automatically, so accountability is documented without manual follow-up.
For API-based discovery: Abacus.AI, ChatGPT, Claude managed agents, Gemini, LangSmith Fleet, Microsoft Copilot Studio, n8n, Notion AI agents, Salesforce Agentforce, ServiceNow, Tines, and Workato. For browser-based discovery: Amazon Quick, Atlassian Rovo, ChatGPT workspace agents, Cursor automations, Datadog, HubSpot, HyperAgent, OpenAI Agents Workflows, Retool, Zapier Agents, and Zoom AI Workflows, with more being added based on where customers are seeing the most agent activity. Every discovered agent, regardless of channel, appears in a single inventory view.
Yes. Nudge Security discovers agents regardless of whether IT sanctioned them. Shadow agents—especially those built on platforms without APIs—are often the ones with the broadest access and least oversight. They can connect to sensitive data sources, run with elevated permissions, and stay active long after the person who built them has moved on. You can't govern what you don't know is there.
For every agent Nudge Security finds, you get who built it, which platform it runs on, when it was created, what it connects to, what permissions it holds, and what risk signals it's carrying. You can also set the agent's approval status, assign a technical contact, and capture the creator's stated intent through a nudge response—all in one place.
Nudge Security automatically evaluates every agent for risk signals including publicly accessible agents, agents with excessive or destructive permissions, risky OAuth grants the agent has been given to connect to other SaaS apps, hardcoded credentials in agent instructions, unauthenticated MCP connections, integrations with high-risk apps, and agents whose creators have left the organization. Every flag maps to a specific, actionable finding so your team knows exactly what to do next.
An AI agent's OAuth grants determine what it can actually touch once it's connected to a SaaS platform, and that's often broader than the permissions visible inside the agent builder itself. Nudge Security surfaces both: the permissions set on the agent and the OAuth grants it's been given to other connected apps, so your security team can see the full access picture rather than just the agent-level view. This ties directly into OAuth risk management, the same inventory and revocation workflow that covers every other OAuth-connected app in your SaaS estate, agents included.
‍
