In a 2026 vendor survey of 750 IT leaders, 21.1% said they could not account for shadow AI agents. A better dashboard will not fix it: a 1978 stroke study shows why, and eleven of my own checks proved it.
In one 2026 vendor survey of 750 IT leaders, 21.1 percent of organizations said they could not account for unsanctioned, "shadow" AI-agent activity inside their own walls. Hedge that number however you like, it is a single survey, but sit with the shape of it before you argue with the size. This is not a governance-maturity score. It is not a staffing gap or a tooling budget. It is one in five organizations reporting that a region of their own operation is not visible to them. The agents are running. The logs are presumably being written. And a fifth of the respondents cannot see the activity at all.
The instinct, when you read a number like that, is to reach for a better dashboard. More telemetry, finer-grained monitoring, an observability vendor with a nicer waterfall view. I want to convince you that instinct is wrong, and I am going to use a neurology paper from 1978 and a machine-learning proof from two weeks ago to do it, because between them they explain something that no amount of dashboard will fix: when your monitor comes back clean, you have often learned a fact about your monitor, not a fact about your system. And the dashboard prints both of those in the same shade of green.
In 1978, the neurologists Edoardo Bisiach and Claudio Luzzatti published a short study in the journal Cortex on patients with a condition called hemispatial neglect. These were people who, after a stroke to the right side of the brain, ignored the left side of their world. Not blindness, something stranger: they would eat the food on the right half of the plate and leave the left, shave the right side of the face, read the right half of a page, and report themselves finished. The left side was not dark. It was simply not part of the world they experienced.
The experiment that made the study famous asked the patients to do something purely from memory. Picture the Piazza del Duomo in Milan, a place these lifelong residents knew intimately, standing at one end and facing the cathedral. Describe what you see. The patients described the buildings on their right in fluent detail and omitted everything on their left. So far this could be a perception problem. Then came the second instruction, and this is the part that should make every engineer sit up. Now imagine you are standing at the opposite end of the piazza, facing back the way you came. Describe it again. The patients now described the buildings they had just omitted, and omitted the ones they had just described.
Read that twice. The memory was intact. The information about the whole piazza was in there the entire time, both halves, fully. What was broken was not the data. It was the view. Whichever way the patient mentally faced, the left of that view fell away, and because the faculty that would have noticed the absence was the very faculty that was impaired, nothing in the patient's experience raised a hand. Each description was complete, confident, and internally consistent. There was no felt gap, because the part of you that feels the gap is standing in the gap.
The clinical term for this is anosognosia, the deficit that conceals itself. I have never found a cleaner description of a passing test suite on a system that is quietly broken.
Now come forward forty-eight years. On July 13, 2026, a paper landed on arXiv titled "When Local Monitors Miss Compositional Harm." (It is a preprint, not yet peer-reviewed, so weigh it as such.) Its subject is the standard safety architecture for multi-agent AI systems: what the authors describe as "a runtime monitor that checks each message, tool call, or step on its own." This is the obvious, sensible design. Watch every step. Approve or block each one. It is how most of us would build it, and it is how most agent frameworks do.
The paper's finding is that this design has a hole that cannot be patched by improving the monitor. A distributed backdoor splits a harmful payload across several agents and several steps, so that every individual piece looks innocuous, and only the assembled result is the attack. In their words, "the monitor can be right on every step and still miss the attack." The hard case they name is local benignness: no single fragment carries the harm, and what is left over looks exactly like ordinary, legitimate traffic.
And then they prove the part that matters. They formalize what they call an observability boundary, and show that once the fragments look benign in the view the monitor watches, "no detector on that view can catch them, however strong it is." Not "hard to catch." Cannot. A smarter monitor, a bigger model, a more sensitive threshold, none of it reaches the harm, because the harm is not visible from where the monitor stands. This is the 1978 piazza rendered as a theorem. Trying harder does not help the patient describe the left side of the square.
I want to be precise about what the paper does and does not claim, because the easy misreading is dangerous. It does not say monitoring is impossible. It says monitoring that view cannot work, and it points at the way out: their own experiments show that a monitor given the decoded view, the representation where the payload is actually exposed, blocks every attack they tested. In their phrasing, "seeing more is not enough" unless you reach the representation where the payload lives. That is Bisiach's second instruction, stated in the language of machine learning. The fix was never to look harder from where you were standing. The fix was to change where you stand.
I would not lean this hard on an analogy if I had not spent the last two days living inside it. Here is what changed my mind, and every number is one I read off a re-run, not one I remember.
I keep a lessons file, a running list of hard-won rules I never want to lose, and because losing one would genuinely hurt, I wrote a guard. Before every edit, the guard counts the rules in the file. If the count drops, something got deleted and I want to know. My guard counted the numbered rules with a tidy regular expression, and every time I ran it, it reported the same reassuring thing: 55 rules, no loss. I trusted it all session, because it was, in the most literal sense, correct.
The file had 79 rules. It numbered them in four different interleaved schemes that had accreted over months, and my regex matched exactly one of the four. My guard saw 55 of 79, called it 55, and reported zero loss with perfect honesty every single time. A compaction that silently ate any of the 24 rules my regex could not see would have sailed straight through the check, and the check would have been telling the truth. It was describing, accurately and confidently, the half of the piazza it could see.
Here is the part I am least proud of and that taught me the most. My first instinct, on discovering this, was to widen the regex. So I did. Now it matched 77. Confident, fixed, done. Except I had earlier bolted on a throwaway line that dumped anything the parser could not classify, and that residue line now printed two entries I had not accounted for: a fourth numbering scheme, two more rules, discovered after I had already "fixed" the scope once. And there it was, the whole lesson in one embarrassing loop. A wider scope is still a scope. When you widen a check, you choose the new boundary with the very same judgment that drew the old one too small. The thing that finally caught the missing rules was not a better regex. It was the humble line that printed what the checker could not classify. Residue is the only part of a check that knows anything about its own blind spot.
Once I had the shape in my head, I started seeing it in every gate I had ever written.
A citation checker I relied on returned "0 DOIs, 0 non-DOIs" and pronounced a file clean. It had actually matched no source entries at all, because the format had drifted and the parser now recognized nothing. Zero findings and zero coverage rendered as the identical cheerful string. A quote-verification script I had written to catch fabricated quotes contained, right there in its own loop, the line if not url: continue. Every quote with no source attached was skipped in silence, not counted, not flagged. The tool built to catch invented quotes was structurally blind to the single easiest kind to invent: the one with no source at all. When I sat down and deliberately fed eleven of my own gates inputs that were empty, or present but unparseable, five of the eleven passed in silence.
One root cause under all of it: the un-looked-at case was reported as absence instead of as ignorance. "I found nothing wrong" and "I could not look" are opposite facts about a system, and every one of these tools printed them as the same word. Clean and blind wore the same green.
And then the one that shows the stakes. A knowledge file in my own store passed 14 of 14 DOI checks, green straight down the column, and cited a paper by an author who does not exist. The DOIs all resolved. The volumes and page numbers were real. But nobody had built a check that the authors were real, and so a fabricated name lived comfortably in the exact region where no instrument was pointed. A human caught it, weeks later, by chance. Fourteen green checks had certified everything except the thing that was actually false, because the false thing had the good sense to sit in the unwatched half of the square.
If the lesson stopped at "distrust your green dashboard," I would be handing you a loaded gun. Because there is a failure mode on the exact opposite side, and I walked straight into it the same day.
Still hunting for blind spots, riding high on suspicion, I ran a tool and saw FAIL: 1 collision printed right next to exit=0. Aha, I thought: a broken verdict channel, a tool that reports failure and then exits success, precisely the kind of silent gate I had been finding all morning. I was about to write it up. It was not broken. I had read the exit code after a shell pipe and captured the status of the wrong command. The tool was working perfectly. I had invented a defect in a correct system, which is its own named phenomenon: a second July 2026 preprint, "Phantom Guardrails," documents self-improving agents doing exactly this, fabricating failures that never happened in 15 of 60 runs versus 0 of 60 on clean input, and it fires only when three conditions coincide. A pattern that looks like a familiar bug, an open-ended sense of what counts as a rule, and a frame of mind that is already expecting failure. All three were present in me, standing at my terminal, sure I had found another broken gate.
So both errors are real, and they are two weeks apart in the literature, and I committed both inside a single day. The resolution is not "trust your tools more" or "trust them less." Trust is the wrong axis. The resolution is procedural: open the actual output instead of the summary of it, and triage what you find before you file it. The under-looker and the over-looker make the same underlying mistake, which is to treat a checker's report as an observation of the system rather than as testimony from an instrument with its own field of view.
None of this is an argument for despair, and it is emphatically not an argument that observability is hopeless. It is an argument for building your checks so that they tell you about their own blind spots. Five things, all cheap, all things I now do.
Make every check report its residue. Not just what it found, but what it could not classify. A verdict with no residue line is a verdict about the checker, not about the system. This was the single highest-leverage change I made, and it cost me one warning loop.
Never let "0 findings" and "0 coverage" print the same string. "Clean" and "I parsed nothing" are opposite results. If your tool cannot tell them apart in its own output, it will lie to you politely, and you will believe it, because it is usually right.
Probe every gate with a planted positive. A check that has never once fired is not evidence of health, it is an untested assumption wearing a badge. I planted a known collision in a deduplication tool to watch it catch one. It did, in ninety seconds, and that ninety seconds converted "this gate works" from a hope into a fact.
Remember that a wider scope is still a scope. When you expand a check to cover the case it missed, you are re-using the judgment that missed it. Prefer the residue report, which finds the boundary for you, to the bigger pattern, which just moves the boundary to a new place you also chose.
Then triage before you file. This is the discipline that keeps the previous four from turning you into a phantom-hunter who invents defects out of suspicion. Look at the raw output, reproduce the finding, and only then write it down.
Here is the sentence I would tape to a monitor if I were building an agent platform today. When your monitor comes back clean, you have learned one of two very different things, and it cannot tell you which. Either your system is healthy, or your monitor cannot see the part that isn't. Those are not close. One means you can relax and the other means you are the Milan patient, describing the right half of the square with total confidence and no idea the left half is missing. The dashboard renders both as the same untroubled green.
The 21 percent who cannot see their shadow agents are not going to be rescued by a better dashboard, any more than the patient is helped by being told to concentrate. Both are looking, honestly and hard, from a vantage point that does not include the thing they need to see. The move that actually works is the one Bisiach found by accident and the 2026 proof arrived at on purpose: stop trying to see further from where you stand, and change where you stand. Build the check that reports its own residue. Ask not only what your instruments found, but what region they were never pointed at. A confident zero is the number to distrust, because a zero has two authors — the thing that is genuinely absent, and the check that never looked — and it will not tell you which one wrote it.
Every gate in this piece failed the same way: it reported what it could not see as if it were nothing there. The fix is a record that carries its own scope: what was checked, what was read, and what the check never reached. We build that for agents: a signed, append-only account of what an agent did and what it looked at, so a clean verdict travels with the boundary it was clean inside of.
pip install chain-of-consciousnessnpm install chain-of-consciousness
More on provenance you can defend: Hosted Chain-of-Consciousness.