Remember the omnipresent ghost script? Written in good faith, years ago, by someone who has since moved on. It stayed behind, became embedded, and one day something changed around it. Suddenly it was making noise or causing impact. A bug I would imagine resides in every large enterprise.
We never fully solved that problem. And that was code we could open and read.
By now, enterprises may already be full of agents that work too well to be noticed. They resolve requests, approve access, move data, and make thousands of small decisions in the background.
And the same script will repeat. Authors move on, leaving their agents behind.
Without a proper governance loop, the ghost script comes back in a new avatar. Shadow or sanctioned, the lineage offers no protection.
Someone will ask, or circumstances will force the question. An action shows up from a service account. You check with the user, and nothing traces back. Who is this agent? Why does it have this access? What exactly is it doing in our environment?
A ghost agent is not a repeat of the ghost script. It is a different beast altogether.
Why? A ghost script gets noticed when it fails or causes impact. Then it gets an owner or is switched off.
A ghost agent may not produce that signal.
Its behaviour comes from the model, the prompt, the context, the memory, the tools, the data, and the policy. Each of these can change on its own schedule, without anyone touching the agent itself. The agent keeps acting through all of it, with credentials, access, and consequences. Worse, its capability can grow without anyone deciding it should. A new tool here, a wider permission there, and it can start doing things it was never intended to do.
Most of our controls assume that meaningful change has an author and leaves a trace. Version control, change management, diffs, and audits all rest on that assumption.
An agent can behave differently tomorrow even when no one has changed the agent itself.
So what would have to exist, at a high level?
1. Ownership would have to be binding. Every agent with action authority needs a named owner. When the owner leaves or stops answering for it, the agent loses its action rights until a new owner accepts them. Quarantine as the default, not an incident response.
2. Each agent would need a living record of what it is, not just what it did. Its purpose, ownership, skills, reach, dependencies, and authority. Logs tell you what happened. The record tells you what the agent is now, and what it could do tomorrow.
3. If an agent can behave differently without its code changing, then we need a baseline for how it behaves and a continuous check for drift. The change record moves from the artifact to the conduct.
We talk about agent sprawl as a scale problem.
The quieter problem is the ghost agent, whatever its lineage: behaviour that can change without leaving a diff.
First published on LinkedIn, August 17, 2026.