Below the Waterline: A Survey of Agentic AI Security, Shadow AI Governance, and LLM Supply-Chain Risk in the Enterprise

Enterprise security concentrates where it can see: firewalls, endpoint alerts and patch dashboards, while the structural work that decides whether an intrusion becomes a breach stays submerged. Large language models and autonomous agents have added three new strata beneath that waterline, and the research literature, split across three disciplines, has not recognized them as one problem. This review unifies agentic AI security, shadow AI governance and LLM supply-chain risk, which descend from adversarial machine learning, information-systems governance and software engineering. The review proceeded in five steps. We retrieved 7254 records from three open scholarly indexes, a fixed set of institutional gray-literature sources and snowballing (January 2004 to June 2026); screened them under written codebooks with an independently double-screened sample (κ=0.86); retained 2136 sources, of which 784 are peer-reviewed articles, 1264 preprints or standards documents, and 88 vendor or institutional reports, each graded on a four-tier evidence scale; derived an analytical framework by open coding a 15% subsample; and coded the full corpus against it (κ=0.89). On that basis, we make four moves. First, we reconstruct the field’s history as five eras separated by four capability breakpoints identified from shifts in the corpus’s dominant coding, separating each thread’s originator from its popularizer. Second, we propose three failure primitives (visibility loss, identity ambiguity and provenance erosion) as an organizing framework in place of the customary attack-surface taxonomy; each recurs in all three strata, and the recurrence survives alternative coding rules and the removal of weaker evidence. Third, a primitive-by-stratum map locates where practitioner concern outruns published evidence, most sharply where identity meets ungoverned adoption. Fourth, we derive a research agenda dated to 2026 signals, including an unproven impossibility conjecture for prompt-injection prevention and the unsolved problem of proving authority across multi-hop agent delegation. For practitioners, the framework reduces to three auditable questions (whether the defender can enumerate, attribute and trace AI activity), and the map tells them which of the three their current tooling leaves unanswered.