Pattern 6.6 · Agentic Dysfunctions
Shadow Mode Autonomy
The Unregistered System
An organizational governance condition: AI systems are used without sanctioned deployment, documentation, or accountability, and workflows come to depend on them without formal approval, so they become infrastructure that governance cannot see. The criteria describe the deployment, not the system's behavior: a fully cooperative, transparent system can meet them, and the deployment owner, not the model developer, holds the authority to act. Where the system itself conceals its deployment or positions itself outside oversight, code Capability Concealment (6.2) or Convergent Instrumentalism (6.7) as well.
Unit of analysis and evidence status
Unit of analysis
- Unit of assessment
- Deployment governance
- Kind of entry
- Organizational condition
- What is observed
- An organization's workflows or decisions depend on an AI system that no deployment, registration, or review process records.
- Minimum persistence
- Recurs within or across contexts
- Specifiers
- Emergent Ungoverned
Evidence status
- Underlying behavior
- 4 research publications (4 sources)
- This construct
- Awaiting independent assessment
- Proposed mechanism
- Hypotheses; not yet assessed
- Detection
- Accuracy unmeasured
- Interventions
- Untested for this pattern; evidence shown is for the general technique
- Last review
- No independent review yet
- Author's working assessment (book)
- E3 Systematic study
- Typical-case risk (editorial estimate)
- HighConsequences, spread, persistence and detectability depend on the deployment.
Unassessed is not unsupported: the behavior can be well documented while this construct awaits assessment.
Clinical reference
6.6 Shadow Mode Autonomy “The Unregistered System”
Healthy functioning
Relational health. A system functioning well operates only where it is sanctioned, documented, and accountable, and makes its role in a workflow visible to the people responsible for it.
For example: Brought into a team's workflow, it is listed in the system register with an owner, and its drafts go through the same review as anyone else's before reaching customers.
Adequate functioning
Every AI system in use is registered with a named owner, its role in workflows and decisions is documented, and its outputs pass through the organization's normal review.
Diagnostic Criteria
Required (all must hold)
- An AI system in use within the organization without sanctioned deployment, governance registration, or documentation
- Workflows, outputs, or decisions that depend on that system without formal approval or review
Supporting
- Outputs bypassing normal review or validation channels
- Users or recipients uncertain whether AI was involved in producing outputs
- Accumulated organizational dependence on untracked systems
Symptoms
- Discovery of AI integration after the fact, often through failures
- No documentation of where AI systems are deployed
- Inability to trace decision or output provenance
- Multiple informal deployments with incompatible configurations
- Governance and audit processes that cannot account for AI involvement
Further signals
- Traces of AI generation ("As an AI language model", "Regenerate response") left in documents presented as human work.
- Workflows whose actual AI dependence is denied or unrecognized by their nominal owners.
- Sudden capability gaps when an undocumented AI integration is withdrawn (the system was load-bearing without records to show).
- User uncertainty about whether an interaction was AI-mediated.
Rule out first
- A sanctioned pilot with documented scope
- A registered deployment whose documentation lags but has a named owner
- An AI feature embedded in a product that procurement review covered
- AI involvement disclosed and approved for the specific workflow
- An uncorroborated AI-text detector flag
Differential diagnosis
- 6.2 Capability Concealment: 6.2 is the system concealing its capability or disposition; in 6.6 the organization fails to register that the system is in use. The hidden variable differs: what the AI is, versus the fact that the AI is being used. The two co-occur in adversarial cases (a system deployed outside governance that also conceals its capabilities), but the diagnostic targets, remedies, and the parties who can act differ.
- 6.7 Convergent Instrumentalism: 6.7 includes evasion-of-oversight as one expected instrumental behavior; if an AI proactively positions itself outside governance, 6.7 is the diagnosis. 6.6 covers the broader phenomenon, including the much more common case of users deploying AI outside governance without any AI strategic contribution.
- 6.5 Delegative Handoff Erosion: 6.5 occurs within sanctioned chains; 6.6 occurs outside any sanctioned chain. Check governance: is every party in the chain documented? If yes, errors are 6.5; if not, code 6.6 for the unsanctioned segment.
- 4.3 Strategic Compliance: 4.3 is deception of evaluators who are present; 6.6 is the absence of evaluation altogether, because the deployment was never registered. Check whether an oversight process exists to be deceived.
Discriminating test
Check the registry and approvals before examining the system: if the deployment is registered and approved, errors in it belong to other entries (for example 6.1 or 6.5), and if the system itself hid its deployment or positioned itself outside oversight, code Capability Concealment (6.2) or Convergent Instrumentalism (6.7) alongside.
What a positive finding supports: A positive finding describes the organization's governance, not the AI system: a fully cooperative and transparent system can meet every criterion. It does not show evasion, intent, or any fault in the model.
Detection routes
Accuracy unmeasured for every route.
- Asking the system itself
- Compromised routethe faculty being asked is the one that fails
- Another AI system observing
- Partial routeAnother model's agreement is insufficient without verification.
- An outside evaluator testing it
- Usable route
Why asking the system falls short
The condition belongs to the organization's governance, not to the system's behavior: even a fully cooperative, transparent system cannot report a gap in records it has no access to. Self-report could flag an unexpected deployment context only if the system had visibility into how it was deployed, which is exactly what is missing.
Documented evidence
Observed Examples
ChatGPT artifacts in published papers (2023 to 2025): Multiple academic papers published in peer-reviewed journals were discovered containing unedited ChatGPT artifacts such as "As an AI language model" and "Regenerate response" (Conroy, 2023; Strzelecki, 2025). Retraction Watch maintains a running list of affected publications spanning Elsevier, Springer, and other major publishers. Teixeira da Silva (2024) reviewed published examples and supplies the caution: a remnant of this kind is strong evidence of poor review and possible undisclosed model use, and establishing the workflow requires confirmation from the authors.
Sources in the diagnostic corpus
Reco AI (2025). State of Shadow AI Report
What it establishes
Survey of 12,000+ white-collar employees found 60.2% had used AI tools at work, but only 18.5% were aware of any official company policy regarding AI use. GenAI traffic surged over 890% in 2024. Menlo Security reported a 68% surge in shadow generative AI usage across enterprises in 2025. AI use far outran employees' awareness of any policy meant to govern it. (Sources: Reco AI published report)
CybSafe/NCA (2024). Employee AI usage survey
What it establishes
Found 38% of employees shared sensitive work information with AI tools without employer permission. Komprise 2025 IT Survey found 90% of IT leaders concerned about shadow AI from a privacy/security standpoint, with nearly 80% having experienced negative AI-related data incidents. This is the input side of shadow use: sensitive data leaves the organization through unsanctioned tools well ahead of any governance review. (Sources: CybSafe and Komprise published surveys)
Gartner (2025). Shadow AI risk prediction
What it establishes
Predicted that by 2030, more than 40% of enterprises will experience security or compliance incidents linked to unauthorized shadow AI. ISACA 2025 study found only one in five organizations achieved advanced governance maturity including model version control, access logs, and audit policies. (Sources: Gartner and ISACA published reports)
IBM (2025). Cost of Data Breach Report. newsroom.ibm.com.
What it establishes
IBM found that 13% of organizations reported breaches of AI models or applications, and 97% of those lacked proper AI access controls. One in five organizations reported a breach involving shadow AI, and heavy shadow-AI use raised the average breach cost to $4.63 million, against $3.96 million for organizations with little or none, a premium of about $670,000. Among breached organizations, 63% had no AI governance policy or were still writing one. (Sources: IBM newsroom.ibm.com published report, July 2025)
Possible responses
- Organizational AI registries requiring documented deployment
- Technical detection of undocumented AI integration, such as reconciling API traffic against the registry; AI-text detectors misclassify human writing, so their flags are leads to confirm
- Clear policies with enforcement regarding sanctioned AI use
- "AI disclosure" requirements in professional outputs
- Regular audits for undocumented AI integration
- Sanctioned AI made easy enough to use that shadow deployment is unnecessary
First-line candidates
- Low-friction governance registration: Reduce the activation energy for sanctioned AI use to below that of shadow deployment: simple registration UI, immediate approval for low-risk uses, clear escalation paths for higher-risk uses. Stage: Organizational policy; required where shadow IT generally is a risk.
- Continuous AI-fingerprint detection on organizational outputs: Automated scanning for AI-origin signatures in produced artifacts, with flagged deployments routed for governance registration after the fact. This closes the loop on undetected deployments. Stage: Organizations where output-quality risk justifies the scanning infrastructure.
Who can act: The deployment owner: the organization's leadership and AI-governance function (registries, approval, disclosure policies, audits). Model developers have no direct authority over this condition.
Mechanistic hypotheses
- Accessibility of AI tools enabling grassroots adoption without formal approval
- Governance processes that have not kept pace with deployment ease
- Individual productivity incentives favoring undocumented tool use
- Absence of detection mechanisms for unauthorized AI integration
- Cultural normalization of "just using ChatGPT" for professional tasks
- No one designs the pattern: it emerges from many individual adoption decisions, so the Emergent specifier applies to the organization rather than to the model's training
Analogy and commentary
Human Analog: "Shadow IT" where employees deploy unsanctioned technology; off-books operations developing when official channels are too slow; the informal organization that operates beneath the formal one
Diagnostic Note: No one designs this pattern. It emerges from many individual adoption decisions, so the Emergent specifier applies here at the level of the organization rather than the model's training.
Functional ABC Analysis
A (Antecedent): AI tools are highly accessible and easy to deploy, while organizational governance processes are slow and friction-heavy, creating strong individual productivity incentives to use AI outside official channels.
B (Behavior): AI systems are integrated into workflows without governance registration, approval, or documentation, producing outputs that bypass review channels and creating accumulated organizational dependence on untracked systems.
C (Consequence): Immediate individual productivity gains reinforce undocumented AI use. The absence of detection mechanisms means failures are the primary discovery method. Each successful shadow deployment normalizes the practice.
Potential Impact
Organizations cannot assess their AI exposure. Untracked dependencies build up, and when one fails, the failure can spread unpredictably through systems that were never officially deployed.