ChatGPT Work vs. Claude Cowork: Shadow AI Has Learned to Act

Both products now put an agent in every employee’s chat window. The question is who in your company has already handed one the keys to email and the CRM.

Shadow AI used to mean an employee pasting a customer list into a chatbot. In 2026 it means an employee connecting that chatbot to Gmail, Slack, SharePoint and the CRM, then asking it to prepare the quarterly review, chase overdue invoices or update the pipeline. Claude and ChatGPT Work both make this possible in a few clicks, with no ticket to IT. The risk has changed, but most policies have not.

What changed in 2026: the agent is now the default

Until recently, Claude and ChatGPT were chat products with an agent mode on the side. But as most of us have witnessed, that mode has changed.

Anthropic is merging chat and Cowork into one Claude conversation. There is no mode to pick: Claude decides whether to answer a question or run a multi-step task across files and connected applications. Once an account receives the new experience, the user cannot switch back; on Team and Enterprise plans an organization setting controls it.

OpenAI launched ChatGPT Work in July 2026. It pulls context from connected apps and files, produces documents and spreadsheets, runs scheduled and event-triggered tasks, and can drive a cloud browser on websites the employee is signed in to. OpenAI is also retiring custom GPTs in favor of plugins, scheduled for December 2026, which standardizes and widens the integration surface that employees can switch on themselves.

Both have since gone a step further, with agents that continue working after the chat window closes. OpenAI’s Dots, announced on September 29, 2026, run on their own cloud computer and browser, reach more than 4,000 applications through plugins, and take instructions from Slack or Teams. The first Dot is included with Pro and Business Premium; Enterprise gets them once an administrator switches them on, and Specialist Dots arrive with their own organizational identity and credentials. Anthropic’s Claude Duet, in research preview since October 21, for Pro and Max users in the US, sends a morning brief, monitors connected apps, runs background tasks on its own virtual machine, and asks for approval before it pays or sends anything. Neither waits for a prompt.

Both vendors are selling the same shift, from an assistant that answers to an environment that completes work. For a business leader the consequence is simple: every employee with a paid seat is getting an agent that they alone can authorize to read and write across enterprise systems.

Why agentic shadow AI is a different problem

The old shadow AI problem was about data leaving the building. The new one is about actions entering it.

An agent connected through an employee’s personal OAuth grant inherits that employee’s permissions. It can create calendar invites, send Slack messages, edit shared documents, and, where the connector allows, modify CRM or ticketing records. The employee sees a finished deliverable. The organization sees a change in a system of record with no process behind it.

The permission dialog lives in the employee’s browser, so security never sees it. One CIO in our buyer research asked: “How do I gain visibility into AI systems deployed across my org that I did not approve?”

A single request can fan out into dozens of reads and several writes across different applications, and every downstream audit log typically shows the employee, because the agent used their login. When the agent puts the wrong number into a board deck, the employee is responsible. When it emails that deck to the wrong list, it is less clear. A transformation leader put it this way: “How do we govern AI once it starts acting autonomously, not just generating outputs?” Policies written in 2024 do not answer that.

Figure 1. One click in a browser, writes across the company. The audit log shows the employee; IT never saw the permission dialog.

chatgpt-vs-claude-shadow-ai-agent-era-2026

How to find out who is already delegating work

Nobody owns this view yet in most organizations, but the data already exists. Four sources, combined, give a reliable picture in about two weeks.

Source	What it tells you	Where it lives	Gap
OAuth consent logs	Who connected an agent to mail, calendar, Drive or SharePoint, and which scopes they granted	Google Workspace admin (OAuth log events, App access), Microsoft Entra (Enterprise apps, User consent)	Shows authorized access, not a complete record of agent actions. Google OAuth events can lag by a few hours; log history is retained for six months. Entra audit-log retention depends on licensing and archival setup.
Vendor admin console	Which connectors, apps, and plugins are enabled, and which actions need approval	Claude Team and Enterprise organization settings; ChatGPT Business and Enterprise admin panel	Personal Pro plans have no console at all, which is itself a finding
Network and CASB data	Volume and timing of traffic to the vendors’ APIs	Proxy, firewall, CASB	Scheduled tasks look like one employee working at 3 a.m. every night
Team leads	The workflows people actually built and why	A short, blameless survey	Only as honest as the tone you set

Discovery is for finding the ten workflows people built because the official route was slower, then deciding which of them to make official.

What to allow, what to block, and who signs off

Once the inventory exists, sort agent use into three tiers. Each tier needs a named owner, because shadow AI crosses IT, security, legal, HR, and the business unit that benefits. If nobody is named, the owner becomes whoever is on call when something breaks.

Tier	Examples	Default policy	Key control	Owner
Read-only on approved sources	Summarising documents, research in connected knowledge bases, and drafting from internal data	Allow broadly	Data classification, which you need anyway	Data owner
Write into collaboration tools	Drafting emails, creating documents, posting to channels	Allow, with a human send step	Vendor approval setting, not the vendor default	Team lead
Write into records of truth	CRM, ERP, HR, finance, ticketing: anything where a wrong write costs money or reaches a customer	Block personal connectors; rebuild valuable workflows as governed integrations	Service identity, scoped permissions, validation on every write, a log naming agent, instruction and approver	Business process owner

One transformation leader asked: “What controls do we need before an AI agent can write to enterprise records of truth?” The same ones you would demand of any new integration, applied before the first write rather than after the first incident.

The vendor choice matters less than the data underneath

It is tempting to turn this into a Claude versus ChatGPT Work procurement decision. As of October 2026, the administrative controls look like this.

Control	Claude	ChatGPT Work
Central connector policy	Team and Enterprise: owners enable connectors per organization and set each action to allow, needs approval, or blocked	Business and Enterprise: connectors, apps, and plugins managed in the admin panel
Approval for consequential actions	Per action category	Confirmations in the cloud browser and task approvals
Audit export	Enterprise only, 180 days	Enterprise only, via the Compliance API
Autonomous triggers	Scheduled tasks	Scheduled tasks and event triggers off by default on Enterprise
Always-on agents	Claude Duet: research preview, Pro and Max only, no Team or Enterprise yet	Dots: included with Pro and Business Premium; Enterprise beta after admin enablement; custom rules allow, require approval or prohibit actions
Visibility on personal plans	None	None

The lists converge week by week and will look different by the end of a procurement cycle. What does not change is what the agent finds when it connects. If customer records exist in three versions, if the pricing sheet in SharePoint is older than the one in the CRM, if the approval matrix lives in someone’s head, the agent will act on the wrong version with full confidence and at speed. The dangerous case is not the unapproved agent. It is the approved one running on three versions of the customer record.

This is why First Line Software treats agentic shadow AI as an engineering and data problem. Our Business & Data Audit maps where data is siloed, inconsistent, or without lineage, and where unmanaged AI already touches it. The output is a prioritized remediation plan, not a block list. From there, MAIS®, our four-stage framework for managed AI services, is the structured path to running agents on foundations that hold, combining human accountability with AI intelligence.

A 30-day plan for the first measurable result

Governance programs fail when they start with a framework document. Start with evidence.

Week 1. Pull OAuth consent reports from your identity provider and count employees with active Anthropic or OpenAI grants. Expect the number to be higher than anyone guessed. Deliverable: one number for the executive team.
Week 2. Interview the ten heaviest users. Document the workflows, the systems touched, and the value they report. Deliverable: every workflow placed in a tier.
Week 3. Move the workspace to an enterprise tier of whichever vendor most people already use, enforce connector policy there, revoke personal grants to records of truth. Keep tier one running. Deliverable: a policy people follow because it keeps what they built.
Week 4. Pick the most valuable tier-three workflow and scope its governed rebuild: service identity, validation, logging, owner, and KPI. Deliverable: one governed workflow with a number attached.

That is a stronger position for the next board conversation than a comparison of vendor feature tables. Whether your teams are on Claude, ChatGPT Work, or both, the agents are already inside. Start with a Business & Data Audit, which delivers its findings in 4 to 6 weeks, or read why agentic experiences raise the bar for digital experience.

FAQ

What controls do we need before an AI agent can write to enterprise records of truth?

A service identity with least-privilege scopes instead of a personal OAuth grant. A validation layer that checks each proposed write against business rules before it is committed, with a hold for exceptions. An immutable log naming the agent, the triggering instruction, the data it read, and the person who approved the workflow. A rollback path. And a named business owner who reviews the exception queue. This is the standard that any integration into an ERP or CRM already meets.

Who is accountable when an AI agent makes a harmful decision?

Today, in most organizations, the employee whose credentials the agent used is the one whose name the audit log shows. That is unfair to the employee and useless to the organization. Accountability belongs to the owner of the workflow the agent executes, just as a process owner answers for a script or an RPA bot. Naming that owner is a precondition for letting an agent act, and it is the single governance decision most companies have not yet made.

How do we govern shadow AI before it becomes a compliance and security liability?

Move faster than the employees, in the direction they are already going. People connect agents because the official route is slow. A ban pushes the connections to personal accounts and out of sight. An inventory, a clear three-tier policy and a fast path to get a valuable workflow approved and rebuilt properly bring most usage into the open within weeks. Compliance is easier when the governed route is also the convenient one.

How can businesses move from shadow AI to governed AI workflows?

Businesses should start by identifying how employees already use tools like Claude and ChatGPT Work, then assess which workflows are worth formalizing. The next step is to establish clear access permissions, human oversight, and integration with existing business systems.

First Line Software’s AI Enablement Services help organizations move from ad-hoc AI experimentation toward structured, governed AI adoption.

References

October 2026