Shadow AI in 2026: What It Is, Real Examples, the Risks and How to Detect It
Shadow AI explained for 2026: a clear definition, the latest survey and telemetry statistics on one basis, real incidents from Samsung to CISA, the risks and rules, a detection coverage matrix, a 30/60/90-day playbook and a sample policy clause.
What is shadow AI? Shadow AI is the use of AI tools, models, agents or AI features for work without the organization’s approval or security oversight. Typical examples are a personal ChatGPT or Claude account used with company files, an unvetted browser extension that reads every page, an AI feature switched on inside an approved SaaS app, or an agent running on a laptop with an employee’s API keys. It is the AI-era version of shadow IT, with one difference: the tool does not just store data, it reads, transforms and sometimes acts on it.
The headline number: in IBM’s 2026 Cost of a Data Breach Report, 43% of breached organizations had a security incident involving shadow AI, up from 20% a year earlier. Those breaches averaged $5.39 million, against a $4.99 million global average (IBM).
Shadow AI is no longer a story about a few early adopters pasting code into a chatbot. Netskope’s 2026 telemetry shows that 44% of workplace AI users still use personal AI apps, and that the long shift toward company-managed tools stalled around March 2026 (Netskope). Meanwhile, the surface has widened from chat windows to coding agents, MCP servers and open-source agents that employees install in one line. How remote MCP servers decide which of those agents get access is covered in our MCP OAuth explainer.
This guide covers what shadow AI is, how common it is (every survey framed on the same basis), real incidents, the risks and rules, and how to detect it, with a coverage matrix, a 30/60/90-day playbook and a sample policy clause.
The short answer (as of November 2026)
- How common: 71% of UK employees have used unapproved consumer AI tools at work (Microsoft UK), and 69% of organizations suspect or have evidence of prohibited GenAI use (Gartner).
- What leaks: in Harmonic Security’s 22.5 million-prompt dataset, code, legal material and M&A data made up most sensitive exposures, and 16.9% of them went through personal free-tier accounts (Harmonic).
- How to detect it: no single tool sees everything. In our matrix the best single method covers 6 of 10 points; a browser layer plus OAuth audits, endpoint inventory and secrets scanning gets you strong coverage on four of five surfaces.
- What works: discovery, an approved alternative people actually prefer, and targeted controls for sensitive data. Blanket bans backfire: uploads of company data were most common where GenAI was banned (67%) (KPMG/University of Melbourne).
What is shadow AI? Definition and scope
Shadow AI covers any AI capability used for work that has not gone through the organization’s approval, procurement or security review. IBM’s breach study uses the plainest wording: incidents “where workers use unapproved AI.” In practice, shadow AI takes five forms:
- Web chatbots on personal or unmanaged accounts, such as free ChatGPT, Gemini, Claude, DeepSeek or Perplexity, used with work content.
- Browser extensions that summarize, rewrite or translate whatever is on the page, and send it to their own back end.
- AI features inside approved SaaS, such as a meeting assistant, an AI connector or a new agent builder that was switched on after the original security review.
- API keys, agents and local models: a developer’s personal model-provider key, a coding agent, an MCP server, or a model running locally in Ollama. Netskope sees Ollama at 41% of organizations and Claude Code at 75% (Netskope).
- Personal and unmanaged devices, where none of the company’s network controls apply.
Scope it by risk: a writing assistant used on public text is not the same problem as an agent with write access to the CRM. The table shows why shadow AI needs its own playbook.
| Shadow IT | Shadow AI | |
|---|---|---|
| What the tool does with data | Stores and syncs it | Reads, summarizes, transforms, may retain or train on it |
| Typical evidence | A domain or a SaaS login | A prompt, an upload, an OAuth grant, an API key, an agent config file |
| Hardest part to see | The app itself | The content and the actions taken |
| New failure modes | Data residency, account sprawl | Prompt leakage, agent overreach, model changes after approval |
How common is shadow AI? The latest statistics, compared
Shadow AI statistics range from 43% to 78% mainly because studies count different things: all employees, only AI users, organizations, or telemetry events. We compiled the newest figures with the base next to each.
| Study | Fieldwork | Sample | Base | Unapproved or personal AI use | Sensitive data signal |
|---|---|---|---|---|---|
| Microsoft UK (Censuswide) | Oct 2025 | 2,003 UK employees | All employees | 71% have used unapproved consumer AI tools; 51% weekly | Only 32% worry about data they enter |
| Gartner | Mar-May 2025 | 302 security leaders | Organizations | 69% suspect or have evidence of prohibited GenAI use | n/a |
| KPMG / Univ. of Melbourne | Nov 2024-Jan 2025 | 32,352 employees, 47 countries | Employees who use AI | 56% used AI without knowing if it was allowed | 48% uploaded company information to public AI |
| Microsoft/LinkedIn Work Trend Index | Feb-Mar 2024 | 31,000, 31 markets | AI users | 78% bring their own AI tools | n/a |
| Salesforce (YouGov) | Oct 2023 | 14,000+, 14 countries | GenAI users at work | 55% used unapproved tools | 40% used banned tools |
| Software AG | Sep 2024 | 6,000 (US, UK, DE) | All knowledge workers | About 50% use non-company-issued AI | 46% would keep using them if banned |
| Netskope Cloud & Threat Report | Oct 2024-Oct 2025 | Customer telemetry | GenAI users | 47% use personal AI apps | 223 GenAI data policy violations per org per month |
| Netskope AI Report | Jun 2025-Jul 2026 | Customer telemetry | AI users | 44% use personal apps (30% only personal) | 69 upstream violations per org per week |
| Harmonic Security | Jan-Dec 2025 | 22.5M prompts, US/UK | Sensitive exposures | 16.9% via personal free-tier accounts | 2.6% of prompts and uploads (our calculation) |
| IBM Cost of a Data Breach | Mar 2025-Feb 2026 | 602 breached orgs | Breached organizations | 43% had a shadow AI security incident | 49% of those led to data loss |
Two newer data points sharpen the picture. Harmonic’s May 2026 analysis of 1.9 million AI-session minutes found that 64.5% of activity on personal and free accounts was business work (Harmonic via Business Wire). And Cisco’s 2026 privacy benchmark found that the share of organizations with outright bans on GenAI use fell from 28% to 7% in one year, as companies moved from prohibition to controls at the point of use (Cisco).
What this means: quote shadow AI numbers with their base. “Most AI users bring their own tools” (Microsoft, 2024) is a different claim from “43% of breached companies had a shadow AI incident” (IBM, 2026). For a board slide, the strongest current pair is Netskope’s 44% of AI users on personal apps (telemetry, July 2026) and IBM’s 43% (breach study, July 2026).
Shadow AI examples: real incidents
These cases show the main shapes shadow AI takes, from a paste into a chatbot to an agent installed outside IT.
| Case | When | What happened | Lesson |
|---|---|---|---|
| Samsung | Mar-Apr 2023 | Engineers pasted sensitive source code into ChatGPT and, reportedly, a meeting recording to get minutes (Engadget); Samsung then restricted GenAI on company devices and networks (TechCrunch) | A ban followed the leak; Samsung also said it was building internal tools, the part that actually removes demand |
| NSW Reconstruction Authority | Mar 2025, disclosed Oct 2025 | A former temporary staff member uploaded a spreadsheet of 12,000+ rows to ChatGPT; 2,031 flood-program applicants affected, including health information (NSW Government) | Contractors are in scope; disclosure came seven months later |
| CISA (US) | Jul-Aug 2025, reported Jan 2026 | The acting director reportedly uploaded at least four “for official use only” contracting documents to public ChatGPT under a special exception, triggering DHS alerts† (Politico) | Exceptions for senior staff are shadow AI with a permission slip; DLP caught it |
| Salesloft Drift | Aug 2025 | Attackers used stolen OAuth tokens of the Drift AI chat agent to pull data from Salesforce and some Google Workspace mail; more than 700 organizations affected (Google Threat Intelligence, FINRA) | Audit which AI apps hold tokens to your core systems, approved or not |
| OpenClaw agents | Jan-Feb 2026 | Exposed instances of the open-source agent grew from 679 to 31,674 in 12 days† (TechTarget, citing Bitsight); one vendor saw about 22% of its customers’ employees using it† (Dark Reading) | Agents inherit the user’s credentials; endpoint inventory finds them, network logs often don’t |
Strictly, Drift was a compromised third-party AI integration, not an employee’s unsanctioned tool. It is here because it shows the cost of not knowing which AI apps hold tokens to your systems, which is what an OAuth audit turns up.
Shadow AI risks
The main shadow AI risks fall into six groups. The first three are about data; the last three are about control.
| Risk | What happens | Why it matters |
|---|---|---|
| Data exposure | Code, contracts, customer data, credentials or deal material go into a tool the company does not control | No contract, retention limit or deletion right; free tiers may train on inputs |
| Identity bypass | Work happens on a personal account outside SSO | No audit trail; the history leaves when the employee does |
| Unreviewed vendor and jurisdiction | A team adopts a provider no one vetted, including China-based tools (4.1% of prompts in Harmonic’s data) | Unknown sub-processors, data location and breach notice terms |
| Agent overreach | An agent or connector gets broad read/write scopes | It can send, change or delete records; stolen tokens become a pivot |
| Drift after approval | An approved tool adds an AI feature or changes model | The original risk review no longer describes the live system |
| Compliance blind spot | The company cannot show what was used, by whom, for what | Breach notification, records and AI literacy duties become hard to evidence |
IBM’s numbers put a price on the problem. Breaches involving shadow AI cost $5.39 million on average in the 2026 report, $400,000 (8%) above the global average by our calculation. In the 2025 report, organizations with high levels of shadow AI paid $670,000 more than those with little or none (IBM 2025). In 2026, 49% of shadow AI incidents led to data loss, 42% disrupted operations and about one in five ended with a regulatory fine. Governance moved the wrong way: 68% of breached organizations had no policy to manage AI or detect shadow AI, up from 63%, and the share requiring IT approval for AI deployments fell from 45% to 38% (IBM 2026 report).
The regulatory angle
- EU AI Act, Article 4 (AI literacy). Since February 2, 2025, providers and deployers must take measures to ensure AI literacy among staff, and national authorities can supervise it from August 2, 2026. The Commission’s Q&A says a company whose employees use ChatGPT to write ads or translate text is in scope (European Commission). The Digital Omnibus, in force since July 27, 2026, kept the duty but dropped the requirement of a “sufficient level” (Regulation (EU) 2026/1744). You cannot train people on tools you do not know they use.
- GDPR. Pasting personal data into an unvetted tool means processing without an Article 28 processor contract and, often, without the security Article 32 requires. If it is a personal data breach, Article 33’s 72-hour notification clock applies (GDPR). A Rome court annulled Italy’s €15 million ChatGPT fine in March 2026 on jurisdiction, not the merits (Reuters); the uploading company’s own duties are untouched.
- Sector rules. In US healthcare, a tool that receives protected health information needs a business associate agreement under HIPAA (HHS), which consumer chatbots do not sign. FINRA says its rules are technology neutral (Regulatory Notice 24-09) and that GenAI use can implicate supervision, communications and recordkeeping rules (FINRA 2026 report), so business conversations in a personal AI account raise the same questions as off-channel messaging.
How to detect shadow AI
Shadow AI detection is an evidence-reconciliation problem. A firewall sees a domain, an expense system a subscription, an identity provider an OAuth grant, an endpoint agent a local model, a survey intent. None is a full inventory alone. The eight sources:
- DNS, firewall and proxy logs. Search for traffic to AI domains and model APIs (such as api.openai.com from servers). Cheap, but leads only: no account, no content, and embedded AI hides behind the parent SaaS domain.
- CASB or SSE with inline inspection. SSE platforms classify AI apps, separate corporate from personal instances, and apply DLP to prompts and uploads on managed traffic. Microsoft’s Defender for Cloud Apps, for example, keeps a Generative AI category in its app catalog and can block unsanctioned apps on onboarded devices (Microsoft Learn).
- Browser extension or enterprise browser. Most shadow AI happens in the browser, so a managed extension sees prompts, uploads, the account in use and installed extensions. It is the strongest single source in our matrix.
- OAuth grant and SaaS integration audit. List every third-party app with tokens on mail, drive, calendar, CRM and code. This finds AI note-takers, connectors and agents, and grants follow the account onto any device.
- Expense, card and SaaS spend data. Search cards and reimbursements for AI subscriptions, add-on SKUs and API bills. Finds paid tools, misses everything free.
- Endpoint (EDR or MDM) inventory. Look for desktop AI apps, local model runners such as Ollama, agent CLIs and their config folders. Gartner’s May 2026 research argues for stricter endpoint application control for exactly this reason (Gartner).
- Code, secrets and cloud-billing scans. Scan repositories, CI logs and cloud bills for model-provider keys, AI SDKs and unapproved endpoints. Rotate exposed keys and preserve evidence before deleting anything.
- Employee survey or amnesty. The only source that tells you why. Run it as a safety exercise, not a hunt: KPMG found 57% of employees already use AI non-transparently.
Shadow AI detection coverage matrix
We scored each method against the five shadow AI surfaces: 2 means it can reliably see that surface on managed infrastructure, 1 means partial or lead-only visibility, 0 means blind.
| Method | Web chatbots | Browser extensions | Embedded SaaS AI | API keys & agents | Personal devices | Score /10 | Sees prompts? | Effort | Cost |
|---|---|---|---|---|---|---|---|---|---|
| Browser extension or enterprise browser | 2 | 2 | 1 | 0 | 1 | 6 | Yes | Medium | $$ |
| CASB / SSE inline | 2 | 1 | 1 | 1 | 0 | 5 | With inline DLP | Medium | $$ (often licensed) |
| OAuth and SaaS integration audit | 1 | 0 | 2 | 1 | 1 | 5 | No | Low | $ |
| Employee survey or amnesty | 1 | 1 | 1 | 1 | 1 | 5 | Self-reported | Low | $ |
| Expense and SaaS spend data | 1 | 0 | 1 | 1 | 1 | 4 | No | Low | $ |
| Endpoint (EDR / MDM) inventory | 1 | 1 | 0 | 2 | 0 | 4 | No | Medium | $$ (existing EDR) |
| DNS, firewall and proxy logs | 1 | 1 | 0 | 1 | 0 | 3 | No | Low | $ |
| Code, secrets and cloud-billing scans | 0 | 0 | 0 | 2 | 0 | 2 | No | Medium | $-$$ |
What this means: the cheapest strong stack is a browser layer (chatbots and extensions), an OAuth audit (embedded AI and connected agents), endpoint inventory plus secrets scanning (keys, agents and local models), and a survey to explain the why. Personal devices never score above “partial”, so the real control there is policy, conditional access to corporate data and an approved tool good enough that people choose it.
Shadow AI detection tools: who sells what
Many vendors market shadow AI discovery. This list groups some by where they collect evidence. It is not a ranking; we have not tested these products, and descriptions come from vendor pages.
- Security service edge and CASB: Netskope, Zscaler, Palo Alto Networks AI Access Security, and Microsoft through Defender for Cloud Apps and Entra Global Secure Access, which also flags traffic to SaaS MCP servers and model APIs.
- Browser and prompt layer: Harmonic Security, Push Security and SentinelOne’s Prompt Security, which SentinelOne acquired in September 2025 (SEC filing).
- Data security and DLP: Cyberhaven, Nightfall and Microsoft Purview DSPM for AI.
- SaaS, identity and spend discovery: Nudge Security (workspace and OAuth integrations plus a browser extension) and Zylo (SaaS and AI spend).
- AI governance platforms: ServiceNow announced shadow AI detection for its AI Control Tower in October 2026, with availability expected in Q4 (ServiceNow). Our AI governance tools comparison covers that category in depth.
For the wider security market, see our list of top AI cybersecurity companies. Ask each vendor which of the five surfaces it covers, whether it separates personal from corporate accounts, and what it sees off-network.
What to do after you find shadow AI
Decide by data and capability, not by tool name. A public-data summarizer and an agent connected to payroll should not get the same response.
| What you found | Default response |
|---|---|
| Public or sanitized data, no integrations | Allow, or move to the approved equivalent; log it in the inventory |
| Internal data on a personal account | Migrate the user to the enterprise tier of the same or an approved tool |
| Confidential data, source code or regulated data | Review contract, retention and DLP before any approval; block personal accounts for this data |
| Agent or connector with write access | Scoped credentials, tool allowlists, approval gates, action logs and a kill switch |
| Unknown provider or high-risk jurisdiction | Restrict while the owner and security team investigate |
| Confirmed exposure of sensitive data or credentials | Treat as an incident: preserve evidence, rotate keys, assess notification duties |
Record each finding in an AI inventory: tool, provider, discovery source, users, purpose, data, account type, permissions, owner, risk tier and next review. Our AI audit checklist lists the evidence auditors expect to see behind that inventory, and the AI readiness assessment scores the governance maturity around it.
A 30/60/90-day shadow AI response playbook
| Phase | Goals | Actions | Exit metric |
|---|---|---|---|
| Days 1-30: See it | A first inventory without blocking anything | Pull DNS/proxy and CASB reports; run an OAuth grant export; search expenses; deploy a browser extension to a pilot group; launch an anonymous survey with a no-blame message; name an owner | Top 20 AI tools ranked by users and data sensitivity; owner per tool |
| Days 31-60: Redirect it | Give people a better approved path | License an enterprise AI tool for the heaviest teams; publish the approved list and a one-page policy; set DLP rules for code, credentials, customer and deal data; revoke risky OAuth grants; start AI literacy training | Share of AI users on managed accounts rising; DLP alerts triaged within agreed time |
| Days 61-90: Govern it | Make discovery continuous | Add endpoint rules for local models and agents; scan repos for model keys; add AI questions to SaaS intake and renewals; define agent permissions; report monthly to the risk committee | Coverage on at least four of five surfaces; new tools reviewed in days, not months |
If your organization deploys agents, add MCP to that last phase: our MCP security guide covers shadow MCP servers and token scopes. For teams that want to remove the demand for personal chatbots altogether, a private LLM is one way to offer an approved tool that keeps data in-house. A managed plan such as ChatGPT Enterprise is the other common route, giving staff a sanctioned version of the chatbot many already use.
Shadow AI policy: what to include, plus a sample clause
A shadow AI policy people follow answers five questions plainly: which tools are approved, what data never goes into AI, when extra approval is needed (agents, integrations), which outputs need human review, and how to report a mistake or request a tool. Use examples: “no source code, customer lists, deal documents or credentials” beats “no confidential data.”
Sample clause: use of AI tools
- Employees and contractors may use for company work only the AI tools listed on the Approved AI Tools page, signed in with their company account.
- Do not enter confidential, personal, regulated or customer data, source code or credentials into any AI tool that is not approved for that data class, including on personal devices.
- Connecting an AI tool or agent to company systems (mail, files, code, CRM) requires prior approval from IT Security, and agents may run only with the permissions approved for them.
- You are responsible for reviewing AI output before it is used in decisions, code or communications outside the company.
- To request a new tool, use the AI intake form; requests are answered within five business days. If you think company data went into an unapproved tool, report it to security@ immediately. Prompt self-reporting will not be treated as misconduct.
Have legal review it against local employment and monitoring law.
Shadow AI FAQ
What is shadow AI in simple terms?
Shadow AI is any AI tool, feature or agent used for work without the company’s approval, such as a personal ChatGPT account used with work documents.
What are examples of shadow AI?
Personal chatbot accounts used with company data, AI browser extensions, AI note-takers, AI features enabled inside approved SaaS, personal API keys in code, and agents such as OpenClaw on work laptops.
What are the biggest shadow AI risks?
Data exposure, identity bypass, unvetted vendors, over-permissioned agents, tools that change after approval, and audit blind spots. IBM puts shadow AI breaches at $5.39 million on average.
How do you detect shadow AI?
Combine sources: a browser layer or SSE for chatbots, OAuth audits for embedded AI and agents, endpoint and secrets scans for local models and keys, spend data, and a survey. No single source covers everything.
Should companies ban public AI tools?
Rarely. KPMG found uploads of company data were most common where GenAI was banned, and Cisco reports bans fell from 28% to 7% in a year. Approved alternatives plus targeted controls work better.
Is shadow AI always a security incident?
No. Unapproved use is a governance issue until sensitive data, credentials or unauthorized actions are involved. When they are, handle it as a potential incident and check breach-notification duties.
Methodology and sources
Figures reflect sources available on November 5, 2026, each logged with its URL in our research file. Survey and telemetry figures use their publisher’s base; we did not adjust or combine them. The 2.6% sensitive-prompt rate and the $400,000 cost gap are our calculations from Harmonic and IBM figures. Telemetry from Netskope and Harmonic comes from vendors that sell controls for this problem and reflects their customer base. Items marked † rest on press reports rather than a primary document.
The detection coverage matrix is The Brief Script’s assessment of what each data source can technically observe on company-managed infrastructure, scored 2 (strong), 1 (partial or lead-only) or 0 (blind) for each of five surfaces, for a maximum of 10. Effort and cost are relative: $ means existing tools or logs, $$ a new license or rollout. It is not a test of any vendor’s product, and vendors within a category differ.
This article is information, not legal advice. Check monitoring and data-processing plans with legal, privacy and HR before you deploy them.