Shadow AI is the unsanctioned use of artificial intelligence tools, large language models, or embedded AI features by employees or end users without the formal approval, visibility, or oversight of an organization's IT and security teams. This often includes generative AI platforms, chatbots, or AI-driven applications that employees access independently to automate tasks, generate content, or solve problems.
Key risks:
How to manage it:
This is part of a series of articles about agentic AI security.
In this article:
Shadow IT describes any technology, application, or service used within an organization without explicit IT department approval. This includes unsanctioned cloud storage, SaaS applications, or personal devices connected to corporate networks. Shadow AI is a specific subset of Shadow IT focused on the use of artificial intelligence tools, particularly those that process data autonomously or leverage external AI models.
The primary difference lies in the nature and scope of the risks. While Shadow IT typically involves concerns about data leakage, compliance, and system integration, Shadow AI introduces additional complexities. AI systems can process and generate new data, learn from sensitive information, and share data with external providers. This makes the potential impact of Shadow AI breaches broader and harder to detect, requiring more specialized controls and monitoring than traditional Shadow IT.
There are several reasons that employees and other users resort to shadow AI:
When employees use AI tools outside of IT’s control, there’s a high risk that sensitive or confidential data may be exposed to third parties. Many generative AI services process data in the cloud, and the terms of service for these tools often allow the provider to store, analyze, or use submitted data to improve their models. This can result in sensitive customer information, internal documents, or proprietary business data being stored on external servers without adequate protection.
The potential consequences of such exposure include:
Organizations subject to data privacy laws like GDPR or HIPAA may face hefty fines if protected information is mishandled. Because IT lacks visibility into Shadow AI usage, detecting and responding to breaches is significantly more difficult, compounding the risk.
Shadow AI can also lead to the unintentional sharing or loss of intellectual property (IP). Employees may use AI tools to draft presentations, analyze code, or generate creative content, inadvertently uploading information to external platforms, including:
Many AI providers reserve the right to retain and use input data, increasing the chance that sensitive IP could be incorporated into future AI model training or exposed to other users. Loss of IP control can undermine a company’s competitive advantage and erode trust with partners or clients. The risk is particularly acute in industries reliant on innovation, where leaked trade secrets or source code can have long-lasting negative effects.
The use of unauthorized AI tools introduces new attack vectors for cybercriminals. Some AI applications, especially those from lesser-known vendors, may lack adequate security measures or may themselves be malicious. Employees could inadvertently install AI-powered browser extensions, plugins, or desktop applications that:
Shadow AI also complicates incident response and threat detection. When IT is unaware of the AI tools in use, it’s difficult to monitor for suspicious activity, apply security patches, or enforce access controls. This increases the likelihood of successful phishing attacks, malware infections, or other security breaches that exploit Shadow AI as an entry point.
Related content: Read our guide on browser hijacking, how it works, and ways to prevent it
Shadow AI contributes to tool sprawl: an uncontrolled proliferation of software and services across an organization. Employees may subscribe to multiple AI platforms, each with their own pricing models, leading to:
These hidden costs can quickly add up, especially if expense reports or procurement processes fail to flag unauthorized subscriptions.
Agentic AI can make tool sprawl harder to track because one agent may delegate tasks to other agents, models, or external services. These agent-to-agent interactions can create chains of dependencies that IT did not approve or even know existed. An authorized agent could pass company data or tasks to an unsanctioned agent, expanding data exposure, permissions, API usage, and costs beyond the original deployment.
A common manifestation of Shadow AI is employees turning to public AI chatbots, such as ChatGPT or Google Gemini, to help with work tasks. These chatbots are attractive because they offer instant answers, content generation, and language translation without any setup. Workers may use them to draft emails, summarize reports, or brainstorm ideas, often copying and pasting internal information into the chat interface.
While this can improve efficiency, it exposes corporate data to third-party systems outside the organization’s control. Public AI chatbots may retain input data, use it for training, or share it with other users, depending on their privacy policies. This lack of oversight can result in confidential information leaking beyond company boundaries.
Example scenario:
A sales employee pastes notes from a confidential customer meeting into a public chatbot to generate a follow-up email, exposing customer details and internal pricing information to an unapproved external service.
Employees sometimes upload company documents, such as reports, presentations, or spreadsheets, to online AI tools that offer summarization, translation, or formatting services. These tools promise convenience and time savings but can inadvertently expose sensitive business data to external vendors. Once uploaded, the organization loses control over how the data is stored, processed, or shared.
This practice also raises compliance concerns, especially in regulated industries. Data uploaded to AI tools may be stored in jurisdictions with different privacy laws or may be retained longer than intended. Without IT oversight, there is no guarantee that these services meet the organization’s security or data handling requirements.
Example scenario:
A finance employee uploads an unreleased quarterly report to an online AI summarization service, sending financial results and internal forecasts to a vendor that has not undergone a security review.
Some AI tools offer integrations with popular SaaS platforms, such as Slack, Salesforce, or Microsoft 365. Employees may connect AI-powered assistants or bots to these platforms to automate workflows, schedule meetings, or analyze data. While these integrations can enhance productivity, they often require broad permissions and access to company data, creating potential security gaps.
When such connections are made without IT approval, organizations may lose control over data flows and access privileges. Unauthorized integrations can create backdoors for data exfiltration or introduce vulnerabilities that cybercriminals could exploit. The lack of centralized management makes it challenging to monitor or revoke these connections if issues arise.
Example scenario:
A project manager connects an unapproved AI assistant to the company’s Microsoft 365 environment and grants it permission to read files and email, giving the external service access to data beyond the documents needed for the task.
Developers may use unauthorized AI coding assistants to generate code, explain errors, write tests, or review existing source code. These tools can require developers to send code snippets, configuration files, logs, or repository context to an external AI service. If the tool has not passed a security review, sensitive source code, credentials, API details, or proprietary business logic may leave the organization’s controlled environment.
Unauthorized coding assistants can also introduce security and software quality risks. AI-generated code may contain vulnerabilities, outdated dependencies, incorrect logic, or code copied from patterns with unclear licensing implications. Because IT and security teams may not know the tool is being used, they cannot enforce approved configurations, data retention requirements, access controls, or code review policies.
Example scenario:
A developer sends proprietary source code and application logs to an unapproved coding assistant to troubleshoot an error, inadvertently exposing business logic and an API credential contained in the logs.
SaaS and application discovery tools help organizations identify AI services that employees access without approval. These tools can analyze application inventories, expense data, single sign-on activity, and cloud usage to find services that are not registered with IT. Security teams can then classify discovered AI applications based on their:
Discovery should be continuous because employees can adopt new AI services quickly. Maintaining an inventory of sanctioned and unsanctioned applications also helps teams distinguish legitimate business use from Shadow AI and prioritize tools that require investigation or remediation.
Network monitoring can reveal connections to generative AI platforms and other AI services from corporate devices. Organizations can identify domains associated with AI tools and show which users or devices are accessing them, using:
Browser monitoring provides additional visibility into web-based AI usage. Managed browser controls or security extensions can detect visits to AI services and, where appropriate, restrict uploads or sensitive interactions. Organizations should configure monitoring according to applicable privacy requirements and internal policies.
Identity and access logs can expose unauthorized AI applications that use corporate accounts for authentication. Security teams can review single sign-on records, OAuth grants, login events, and application consent logs to identify employees connecting AI services to company identities or SaaS platforms.
OAuth activity is particularly important because an AI application may request access to:
Reviewing requested scopes and unusual consent events helps organizations identify integrations with excessive permissions and revoke access when necessary.
Data loss prevention (DLP) controls can detect sensitive information being entered into or uploaded to AI services. DLP policies can inspect web traffic, file uploads, clipboard activity, and other supported data flows for information such as:
Organizations can configure controls based on the sensitivity of the data and the risk of the destination. Depending on policy, a DLP system might warn the employee, block the transfer, or generate an alert for investigation. This provides visibility into Shadow AI even when the specific AI application was previously unknown.
AI applications increasingly interact with company systems through APIs rather than visible browser sessions. Monitoring API gateways, cloud logs, service accounts, and outbound API traffic can reveal unauthorized connections to external AI models or AI-powered services.
Security teams can look for:
API monitoring is especially useful for detecting developers who integrate external models directly into scripts or applications without completing the organization’s security and procurement processes.
Here are some of the ways that organizations can minimize the risks associated with shadow AI.
An AI acceptable use policy should define which AI tools employees can use, what data they can provide to them, and which activities require approval. The policy should address public chatbots, coding assistants, AI agents, browser extensions, SaaS integrations, and APIs rather than focusing only on generative AI websites.
Rules should be based on data sensitivity and business risk. For example, organizations can prohibit entering credentials, customer records, source code, or regulated data into unapproved services. The policy should also establish an approval process for new tools and explain how employees can report AI use cases that are not covered by existing guidance.
Key actions:
Organizations need visibility into AI software running on employee endpoints, including desktop applications, browser extensions, command-line tools, and autonomous agents. Endpoint management and security tools can inventory installed software, running processes, extensions, and network connections to identify AI applications that were not deployed through approved channels.
Discovery should also account for AI agents that operate in the background or connect to external models through APIs. Security teams can correlate endpoint activity with application inventories and network telemetry to determine which tools are active, who uses them, and what systems they can access.
Key actions:
Once high-risk or prohibited AI applications are identified, organizations can prevent them from running on managed devices. Application control policies can block specific executables, scripts, browser extensions, or packages while allowing approved AI tools required for legitimate work.
Blocking should focus on risk rather than applying a blanket restriction to all AI software. Controls can consider factors such as vendor approval, requested permissions, data handling practices, and access to sensitive systems. This approach reduces exposure while avoiding unnecessary disruption to approved AI workflows.
Key actions:
Employees need practical guidance on what information is safe to share with AI systems and how to recognize risky tools. Training should explain why prompts, uploaded files, source code, and connected SaaS data can leave the organization's environment and may be retained or processed by external providers.
Training should use examples that reflect actual work. Employees should know how to verify whether a tool is approved, handle sensitive data, review AI-generated output, and request access to new AI services. Regular updates are important because AI products, capabilities, and organizational policies change quickly.
Key actions:
Blocking Shadow AI without providing useful alternatives can encourage employees to find new workarounds. Organizations should offer approved AI tools that address common needs such as writing, research, document summarization, coding, and data analysis while meeting internal security and compliance requirements.
Approved services should provide appropriate controls for authentication, data retention, model training, access permissions, and audit logging. Organizations can also provide managed access to AI models through enterprise platforms or internal gateways. Giving employees a practical path to use AI makes it easier to enforce restrictions on unauthorized services.
Key actions:
Shadow AI becomes hardest to control once unsanctioned tools and AI agents are already running on endpoints. Airlock Digital Agentic AI Usage Control extends application control to the AI layer, giving organizations visibility into AI agent behavior, the ability to define what trusted AI agents are allowed to do, and enforcement where AI actions actually occur, the endpoint. Because AI agents adapt, replan, and continue working toward their objectives rather than stopping when an action is blocked, Airlock Digital focuses on communicating clear operating boundaries and steering behavior in real time, so teams can deploy agentic agents at scale without losing oversight.
Key capabilities of Airlock Digital Agentic AI Usage Control:
Learn more about Airlock Digital Agentic AI Usage Control and see what your AI agents are really doing.