What Is AI Agent Sprawl? The Problem Nobody's Talking About

I run a company building infrastructure for AI agents. Before that, I spent years in operations and supply chain management. And here's what I can tell you from both sides of the table: the people deploying AI agents and the people responsible for what those agents do are almost never the same person.

That gap is where agent sprawl lives.

What agent sprawl actually is

Agent sprawl is what happens when AI agents multiply across your business faster than anyone can track them. A developer sets up a script that calls Claude to automate carrier check calls. A vendor installs an agent that reads your TMS and adjusts rates. Someone in accounting connects an AI tool to QuickBooks. Someone else builds a workflow in n8n that processes EDI documents overnight.

None of these people told each other. Nobody wrote it down. There's no central list. IT doesn't know half of them exist. And every single one of these agents has access to production systems, real customer data, and real money.

That's agent sprawl. It's not a theoretical risk. It's what's happening right now in every company deploying AI.

The numbers are worse than you think

Those aren't projections. Those are current numbers. And they're growing every week because the barrier to deploying an AI agent is now basically zero. Anyone with an API key can set one up in an afternoon.

Microsoft's security team reported that 80% of Fortune 500 companies already have active AI agents in production. But only 6% of enterprises have what anyone would call an advanced security strategy for managing them.

That's a 74 point gap between adoption and governance. And it's getting wider every month.

Why this is worse than shadow IT

People compare agent sprawl to the shadow IT problem from ten years ago, when employees started signing up for Dropbox and Slack without telling IT. And it's a fair comparison. But agent sprawl is materially worse for three reasons.

Agents take actions. A rogue Slack account can leak data. A rogue AI agent can modify shipping rates, approve invoices, change customer records, and send communications to your carriers. The blast radius is completely different.

Agents are invisible. Shadow IT apps show up in SSO logs, browser extensions, and expense reports. An AI agent running as a Lambda function or a background process on someone's machine doesn't show up anywhere unless you're specifically looking for it.

Agents compound. One agent calls another agent. That agent calls an MCP server. That server hits your TMS. The chain of responsibility is three or four layers deep, and if something goes wrong at the end of that chain, good luck tracing it back to the person who set up the first link.

What it looks like inside a logistics company

I'll make this concrete because the abstract version doesn't capture how bad it gets.

A mid-market 3PL running 500 loads a week might have a dozen AI agents active at any given time. Some they know about. A check call automation agent their dev team built six months ago. A rate quoting bot connected to DAT and Truckstop. Maybe a document processing agent that pulls BOLs from email and files them in their TMS.

But then there are the ones nobody tracks. A vendor (HappyRobot, LunaPath, whoever) installed an agent that hits their Rose Rocket instance from an IP address nobody recognizes. A dispatcher set up an AI assistant through ChatGPT that has read access to their entire load board. An intern built a script six months ago that's still running on a server nobody monitors.

Ask the VP of Ops how many agents are running in their business. They'll say four or five. The real number is usually two to three times that.

The cost of not knowing

And those are just the security costs. There's also the operational cost: duplicated work, agents working at cross purposes, money spent on inference that nobody's tracking, and compliance exposure that nobody's documenting.

The EU AI Act takes effect August 2, 2026. High risk AI systems need automated record keeping, continuous risk assessment, and human oversight audit trails. If you can't even tell me how many agents you have, you're not ready for an audit. You're not close to ready.

What needs to change

The fix isn't complicated conceptually. It's the same thing every other infrastructure category went through: you need a single view.

You need to know how many agents you have. Where they are. What they're doing. What they cost. Whether they're compliant. And you need that view to include every agent, regardless of who built it or where it runs.

That's what we're building at Centurian. Not because the technology is interesting (though it is), but because I've been on the operations side of this problem. I've been the person who found out an agent was modifying data in production three weeks after someone set it up. And I've been the person who had to explain to leadership why nobody caught it sooner.

The answer to "why didn't we catch it" is always the same: because nobody had the full picture. Agent sprawl is a visibility problem. Once you can see everything, governance follows naturally.