Shadow AI, Explained: The Unapproved AI Use Draining Corporate Data
Shadow AI is unsanctioned AI use inside companies. What it is, how data actually leaks through it, what it costs, and how governance beats banning it.
In March 2023, three separate incidents over twenty days saw engineers at Samsung’s semiconductor division paste proprietary source code, an internal meeting transcript, and chip test data into ChatGPT. Samsung banned chatbots company-wide that May, then moved to build an internal AI tool for employees to use instead. The incident became the reference case for a problem that has since gotten a name: Shadow AI, the use of AI tools by employees without the knowledge or approval of IT and security teams. The IBM Cost of a Data Breach Report 2025 puts a number on how much that problem now costs: one organization in five has already had a breach tied to unsanctioned AI, and each one runs 670,000 dollars more than a typical breach.
What Shadow AI actually is
Shadow AI extends a familiar problem, Shadow IT, the use of technology outside official approval, but the risk underneath it is structurally different. A file sitting on someone’s personal Dropbox is exposed if that service gets breached. The same file pasted into a public chatbot is exposed to something else entirely: a model that can process it, retain traces of it, learn from it during retraining, and in some cases surface it back to a different user in a different session, all governed by a retention policy set by a vendor who may not comply with GDPR or the company’s own sector rules.
The category is wider than chatbots. It covers code assistants run on personal accounts (GitHub Copilot, Amazon CodeWhisperer), AI-enabled browser extensions, writing and translation tools, open-source models run locally on a company laptop, and AI features quietly switched on inside SaaS products nobody in IT signed off on. Anything that processes company data outside a sanctioned governance boundary counts.
Why it exploded this fast
The scale is not marginal. Palo Alto Networks measures an average of 66 GenAI applications in use per organization, 6.6 of them flagged high-risk, and data-loss-prevention incidents tied to GenAI are up 250 percent, now 14 percent of all DLP incidents the firm tracks. The Netskope Cloud and Threat Report 2026, covering October 2024 through October 2025, found GenAI SaaS users had tripled and monthly prompt volume had grown sixfold, from 3,000 to 18,000 per organization; the most active quarter of organizations now sends more than 70,000 a month.
Three forces feed the growth. Productivity pressure pushes people toward the fastest tool available. The absence of a sanctioned alternative pushes them further: in one healthcare survey, 27 percent of users said the unapproved tool simply worked better than anything the company offered. And governance is largely absent to begin with, IBM’s 2025 report found just 37 percent of organizations have an AI governance policy at all, leaving 63 percent with no framework whatsoever. Personal accounts do the rest of the work, with 47 percent of GenAI users still routing through one, down from 78 percent the year before but still nearly half.
A ban does not close the gap. Samsung tried one and then built an approved alternative rather than relying on the ban alone; a broader pattern documented across surveys shows close to half of employees keep using personal AI accounts even after a formal prohibition. The ban does not remove the behavior, it removes the visibility.
The adoption numbers hold up across independent surveys, not just one vendor’s telemetry. UpGuard’s State of Shadow AI Report 2025, based on 1,500 respondents split between security leaders and employees, found 81 percent of workers and 88 percent of security professionals using AI tools their employer never approved, including the people paid to stop it. Microsoft’s Work Trend Index put the figure at 75 percent of workers using AI at work by 2025; a year earlier, 78 percent of AI users already said they were bringing their own tools rather than waiting for an approved one, a pattern that held from Gen Z through Boomers with only modest variation by age. The overlap between “knows the risk” and “uses the tool anyway” is the uncomfortable part: UpGuard’s data shows awareness of AI data-handling risk does not reduce personal-account use, it barely moves it.
Not every AI tool carries the same risk
OpenAI, Google, and Anthropic all draw a hard line between their consumer products and their business ones. By default, OpenAI does not train its models on conversations, files, or code submitted through ChatGPT Enterprise, ChatGPT Team, ChatGPT Business, or its API. The consumer version of ChatGPT trains on conversations by default, and turning that off takes a manual trip into the data controls most people never open. Shadow AI, by definition, means employees are not on the tier with the contractual protection. An engineer who signs up for a personal ChatGPT account to paste in a code snippet is, by default, handing that snippet to a training pipeline the company never agreed to and would not have approved.
Source: openai.com/enterprise-privacy
The vendor’s home country adds a second layer that goes beyond terms of service. DeepSeek, the Chinese lab whose open-weight R1 model triggered a wave of adoption in early 2025, routes its hosted chat app’s data to servers governed by Chinese law. Italy’s data protection authority, the Garante, ordered DeepSeek blocked across the entire Italian market in January 2025 after the company failed to explain its data practices under GDPR. South Korea barred the app from government devices and its privacy regulator suspended new downloads pending a compliance review; Australia and Taiwan followed with outright bans on government systems. None of these were symbolic gestures. They were formal regulatory and national-security decisions, and they show the risk gap between AI vendors is no longer theoretical: a tool’s country of origin and its default data-handling terms now change the calculus as much as what category of tool it is. A Shadow AI policy that treats “AI tool” as one undifferentiated bucket misses this distinction entirely.
Two distinct ways data actually leaks out
The first is input-based. An employee pastes a document into a chatbot, uploads a file, connects a SaaS tool to an AI service through an API, or grants an OAuth token that gives an AI agent standing access to company systems. That traffic rides ordinary HTTPS, indistinguishable at the network level from any other web request, which is why rule-based DLP tools built to catch known patterns mostly miss it: they were never built to interpret intent inside a natural-language conversation. Harmonic Security’s analysis of 22.4 million enterprise prompts found 665 distinct GenAI tools in active use, only 40 percent of them tied to an official company subscription; nearly 17 percent of the sensitive-data exposures it found, close to 98,000 instances, came from free personal accounts entirely invisible to IT. The data most often involved, per Netskope’s 2026 report, is regulated data, personal, financial, or health information, which alone accounts for 54 percent of flagged GenAI policy violations, ahead of source code at 15 percent and passwords or API keys at 8 percent.
The second is structurally different: memorization inside the model itself. Researchers at the University of Hong Kong built 900 prompts from public GitHub code fragments and used them to extract 2,702 valid credentials from GitHub Copilot and 129 from Amazon CodeWhisperer, at least 200 of them real secrets still traceable on GitHub. Nothing here depends on what an employee typed. A coding assistant trained on repositories containing hardcoded secrets can memorize those secrets and hand them back in a suggestion to a completely different user.
Source: GitGuardian
GitGuardian found more than 1,200 leaked secrets across a 20,000-repository sample where Copilot was active, a 6.4 percent rate, 40 percent higher than the baseline across public repositories generally; private repositories leaked plaintext secrets eight times more often than public ones.
Source: GitGuardian
An attacker only needs to build prompts targeting a credential type, AWS keys, GitHub tokens, Google OAuth secrets, filter the suggestions by entropy and validation pattern, and walk away with something that opens a real system.
What Shadow AI actually costs
The financial numbers converge across sources. IBM’s 2025 report, built on 600 organizations across 17 industries and 16 countries, puts the average breach at 4.63 million dollars for organizations with high Shadow AI exposure, against 3.96 million for those with low or no exposure, a 670,000-dollar gap. Twenty percent of organizations in the study had already been hit, 63 percent had no AI governance, and among those that suffered an AI-related incident, 97 percent lacked proper AI access controls.
The damage does not stop at the invoice. Eighty-six percent of breached organizations in the IBM study reported an operational disruption, order processing, customer service, production lines, and Shadow AI incidents were more likely than other AI incidents to leave sensitive data scattered across multiple environments, widening the blast radius of a single unmonitored tool. Detection takes an average of 247 days, about a week longer than the report’s overall average, a gap that gives an intruder, or simply a curious third party, a long runway before anyone notices.
The Ponemon Institute’s 2026 Cost of Insider Risks report, run with DTEX, puts the annual cost of insider risk at 19.5 million dollars per organization, 53 percent of it, 10.3 million, attributable to non-malicious actors: mostly employees whose only fault was reaching for the fastest tool. For a security leader building a budget case, the arithmetic is direct: a governance program costing less than 670,000 dollars a year pays for itself the first time it stops one breach.
The exposure that matters most: what leaks becomes what gets stolen twice
The categories of data that leak most often through Shadow AI, source code, intellectual property, customer records, regulated data, are exactly the categories with the highest resale and extortion value once they leave the building. IBM’s 2025 report quantifies the overlap directly: breaches involving Shadow AI expose customer PII at a 65 percent rate against 53 percent for breaches without it, and intellectual property at 40 percent against 33 percent.
The gap is not a coincidence and it is not theoretical. Ransomware groups running double-extortion campaigns, encrypting data while threatening to publish it, treat any inventory of exposed sensitive data as a resource to exploit, regardless of how it left the company. A Shadow AI leak does not need to be targeted to become useful to an attacker: an employee pastes a customer list into an unapproved chatbot with no malicious intent, that data sits on a third-party server outside the company’s security perimeter, and an attacker who compromises that service, phishes the employee directly, or simply buys access to a leaked account inherits a ready-made extortion asset. Coveware’s Q3 2025 report on the ransomware economy found data exfiltration present in 76 percent of cases it tracked, even as the share of victims paying fell to 23 percent, a shift that is pushing some ransomware operators toward directly recruiting insiders instead of only exploiting technical footholds; the report cites an affiliate of the Medusa group who tried to bribe an employee directly to deploy ransomware from the inside, the same profile of person a Shadow AI policy gap leaves exposed. DecodeStack has covered how the encryption-plus-leak model works in more detail in a look at a real double-extortion ransomware campaign. Gartner’s own forecast, drawn from a survey of 302 security leaders, projects that more than 40 percent of enterprises will suffer a Shadow AI-linked breach or compliance incident by 2030; 69 percent of those surveyed already suspected employees were using banned GenAI tools.
None of this amounts to a documented case where investigators traced a specific ransomware breach back to a specific, named Shadow AI leak. What exists is a statistical and mechanistic overlap, the same categories of data, the same absence of visibility, not a publicly confirmed chain of custody running from a pasted document to an extortion demand. Breach forensics is only beginning to check AI tool logs as a matter of routine, and that gap may close as it does. Until then, the accurate claim is that Shadow AI creates the conditions double extortion feeds on, not that a named breach has been proven to start there.
Ransomware is the sharpest version of this exposure, not the only one. The same leaked source code and contracts show up in regulatory fines, competitive intelligence loss, and simple customer-trust damage long before any extortion group gets involved. Treating Shadow AI purely as a “ransomware precursor” undersells the everyday cost; treating it purely as “an IT hygiene issue” undersells the ceiling.
It is worth separating this from a related but different trend: AI tools built and deployed by attackers themselves, not by careless employees. ESET has documented PromptLock, described as the first ransomware to use generative AI at runtime, and has separately tracked PromptSpy, an Android malware that calls Google’s Gemini at runtime to carry out remote surveillance. IBM X-Force has documented Slopoly, a backdoor with likely AI-generated code tied to the Hive0163 group’s Interlock ransomware attacks, and Check Point Research has tracked HexStrike-AI, a legitimate open-source penetration-testing framework that threat actors weaponized within hours of its public release to automate the exploitation of newly disclosed vulnerabilities. None of these are Shadow AI in the strict sense, an employee is not the one running them, but they show generative AI now sits on both ends of the same problem: unsanctioned use inside the company creates the exposure, and AI-assisted tooling outside the company increasingly does the exploiting.
The next problem: autonomous agents nobody approved
Shadow AI is moving past single chatbot conversations into autonomous agents that act on their own, at machine speed, with standing access to company systems and no human reviewing each step. A classic Shadow AI interaction is one person pasting one document once. An unsanctioned agent is different in kind: it holds API credentials, chains actions across several services, runs continuously, and decides without anyone signing off on the individual action. Netskope’s 2026 telemetry shows the shift already under way: two-thirds of organizations connect to api.openai.com directly, the access pattern used by automated workflows and agents rather than a human typing into a browser; 33 percent use OpenAI through Azure, 27 percent Amazon Bedrock, 10 percent Google Vertex AI. Bedrock’s user count and traffic tripled in a year; Vertex AI’s usage grew sixfold, its traffic tenfold.
The specific risk vectors are new: MCP (Model Context Protocol) servers that expose internal APIs, browser extensions with agentic capabilities, OAuth-connected agents holding persistent access, and a growing sprawl of API tokens creating access chains nobody is watching end to end. These compound with prompt-injection attacks, which can hijack an unsecured shadow agent into exfiltrating data without it ever being asked to. Gartner expects 40 percent of enterprise applications to embed specialized AI agents by the end of 2026, up from under 5 percent in 2025, an order-of-magnitude jump in exposure inside eighteen months, independent of whatever governance policy is or is not in place by then.
Palo Alto Networks’ Unit 42 Global Incident Response Report 2026 gives this shift a name: LOTAIL, living off the AI land, attackers reaching for an organization’s own internal AI platforms as an attack tool instead of bringing outside malware. Unit 42 documented attackers abusing misconfigured Google Vertex AI permissions to escalate privileges and plant a malicious model as a Trojan horse for exfiltration, and measured how much faster exfiltration has become where AI is involved: the fastest quarter of intrusions now moves stolen data out in 1.2 hours, against 4.8 hours the year before. Eighty-nine percent of the intrusions in the report trace back to an identity failure of some kind, which is the same failure mode behind most Shadow AI exposure: a token, a login, or an API key nobody was tracking. IBM’s 2025 breach report breaks down the causes of AI-related incidents in similar terms: supply chain compromise, apps, APIs, or plug-ins, accounts for 30 percent, ahead of model inversion at 24 percent and model evasion at 21 percent; those supply chain incidents caused broad data compromise 60 percent of the time and operational disruption 31 percent of the time.
The pattern is not hypothetical. Security researchers at Wiz have documented Shai-Hulud and the related s1ngularity campaign, AI-themed malware that hijacked developer command-line tools to exfiltrate GitHub tokens, and a separate breach nicknamed Moltbook: a vibe-coded app whose developer never enabled row-level security on its Supabase database, exposing roughly 1.5 million other users’ API keys, OpenAI, Anthropic, AWS, GitHub, and Google Cloud credentials among them, to anyone who queried it directly. Both show the same mechanics as the Copilot credential research above, playing out one layer up: Shadow AI does not just leak a document, it can open a path straight into a company’s software supply chain.
Governance beats prohibition
The pattern across the industry points one direction. Samsung moved from a blanket ban to building its own internal tool. A health system that deployed Nuance’s DAX Copilot as an approved alternative found the sanctioned tool cut unauthorized use more effectively than enforcement alone. Both point to the same lesson: a prohibition with nothing to replace it does not remove Shadow AI, it just pushes it out of view.
The first real step is mapping what is currently invisible: network traffic to known GenAI API endpoints (api.openai.com, generativelanguage.googleapis.com, Anthropic’s domains), DNS monitoring for AI-related domains, a CASB (Cloud Access Security Broker) layer for SaaS AI discovery, an audit of the OAuth tokens and API connections agents are already using, and an inventory of locally installed open-weight models (Llama, Mistral) that bypass every network control by design.
What follows is a three-tier policy: tools that are approved without restriction, tools allowed under specific limits (a code assistant cleared for non-proprietary code but not for production systems), and tools that are prohibited outright. The policy needs to say plainly which categories of data can and cannot go into an AI tool, and it needs a real approval path for a new tool request, not a black hole. Rule-based DLP alone will not carry this: exfiltration controls need to work in real time regardless of destination and be able to read natural-language interaction with GenAI tools, not just match known file signatures. Browser-level DLP that can catch sensitive data moving into an AI app, paired with endpoint monitoring on copy-paste actions, are the two layers that close the gap rule-based tools leave open.
For engineering teams specifically, the spread of AI coding assistants makes secrets hygiene non-negotiable: automated secret scanning across every repository, centralized credential management instead of hardcoded values, and mandatory review of AI-generated code before it merges to production. GitGuardian’s 6.4 percent figure for Copilot-active repositories leaking at least one secret is reason enough for these controls on its own, independent of any wider AI governance policy.
Regulators have already shown what they do with an unmonitored channel employees use anyway. Between December 2021 and February 2024, the SEC and CFTC fined more than a dozen major banks, including JPMorgan Chase, Bank of America, Morgan Stanley, and Goldman Sachs, for letting staff conduct business over WhatsApp and other messaging apps that compliance could not archive or review. The single largest round, in September 2022, cost eleven firms a combined 1.8 billion dollars; combined penalties from the SEC, CFTC, and FINRA across the full sweep since then exceed 3.5 billion dollars. The finding in every settlement was the same: firms had no archive of what employees discussed on those channels, a recordkeeping failure regulators treat as a violation on its own, independent of whether anything improper was actually said. An unapproved AI chatbot creates the same shape of gap, a channel employees use daily that the company cannot see, archive, or produce on request. Financial services is where the precedent lands most directly today, but the underlying exposure, a live channel outside the record, is not sector-specific.
The legal and compliance side is catching up to the same trend. Regulators and courts increasingly expect an organization to produce a record of what controls were in place before an incident, not just an account of what happened during one. A governance program built around visibility and a workable approved-tools list is, by construction, exactly that record.
Where to start
Shadow AI is not a future risk, it is a running cost. One organization in five has already been breached because of it, at an average premium of 670,000 dollars and a detection window of 247 days, and the data it leaks, source code, intellectual property, regulated records, is precisely what fuels the ransomware economy’s most damaging campaigns. Agentic AI is about to widen that exposure faster than most governance programs can keep pace with. Prohibition pushes the problem out of sight without removing it; visibility into what is actually leaving the company, paired with a sanctioned tool good enough that employees do not need to route around it, is what actually closes the gap. The organizations still waiting for a breach to force the issue will pay the 670,000-dollar premium to learn that lesson directly.
Frequently asked questions
What is Shadow AI?
Shadow AI is the use of AI tools, chatbots, code assistants, browser extensions, or agents, by employees without the approval or oversight of a company’s IT or security team. It extends Shadow IT but carries a different risk: the data does not just sit somewhere unmonitored, a model can process it, retain it, and in some cases surface it to someone else later.
How is Shadow AI different from Shadow IT?
Shadow IT means using an unapproved service, a personal cloud drive or messaging app, where the main risk is that service getting breached. Shadow AI means feeding data into a system that can learn from it, memorize it, and be prompted by someone else to reproduce it, which is a different and often less visible kind of exposure.
Does banning AI tools at work actually stop Shadow AI?
Banning AI tools at work rarely stops Shadow AI on its own. Samsung banned ChatGPT company-wide in May 2023, after employees pasted proprietary code into it, then moved to build an internal AI tool rather than relying on the ban alone. Surveys of employees after formal bans consistently find close to half keep using personal AI accounts anyway; the ban mostly removes visibility rather than the underlying behavior.
Is Shadow AI connected to ransomware attacks?
Shadow AI can be connected to ransomware attacks. The data types that leak most often through unsanctioned AI use, source code, customer records, contracts, are the same categories ransomware groups value for double-extortion campaigns that pair encryption with a threat to publish stolen data. A Shadow AI leak does not need to be targeted to end up feeding one of those campaigns; an attacker only needs to reach the exposed data afterward.
What is the first practical step to reduce Shadow AI risk?
Map what is currently invisible before writing any policy: network and DNS traffic to known AI endpoints, a CASB layer for SaaS discovery, an audit of OAuth tokens and API connections already in use, and an inventory of any AI models running locally on company laptops. Policy only works once the actual usage is visible.
Does it matter which specific AI tool employees use, or is the risk the same everywhere?
Which specific AI tool employees use matters considerably. OpenAI, Google, and Anthropic do not train on data submitted through their enterprise tiers by default, but consumer accounts, the ones Shadow AI usually involves, often do unless a user opts out manually. Vendor origin adds another layer: DeepSeek’s failure to explain its data practices led Italy to block it nationwide and led South Korea, Australia, and Taiwan to ban it on government devices, showing the risk profile of an AI tool depends heavily on which one it is, not just whether it is approved.
