What shadow AI is, in one paragraph
Shadow AI is any AI tool, model, or agent used for work that your IT and security teams have not approved and cannot see. Microsoft's definition, written for the admins who deal with it, is more useful than most: consumer-facing AI applications and standalone agents deployed across your organization without IT visibility or approval, which can operate autonomously on user devices and create blind spots in your security and compliance posture. The two halves matter separately. Visibility is the security problem, approval the governance problem, and either can fail alone. Sources: Microsoft Learn.
Shadow IT is usually an unapproved place where data sits. Shadow AI is an unapproved place where data goes, gets processed, and sometimes gets acted on. A rogue file-sharing account leaks what you put in it. A rogue agent holding your session cookies can read what you never put in it.
Near-universal AI use is now the baseline. Stanford HAI's 2026 AI Index reports that 88 percent of surveyed organizations used AI in 2025. Asking whether shadow AI exists in your organization is not a useful question. Asking what fraction of your AI use you can see is. Sources: Stanford HAI.
The two headline numbers disagree, and both are right
Read only the breach research and shadow AI looks like it is exploding. IBM's 2026 Cost of a Data Breach Report, published July 29, 2026 and built on 602 organizations that suffered an incident between March 2025 and February 2026, found the share of security incidents involving shadow AI more than doubled year over year, to 43 percent. More than two thirds said they had no governance process to limit shadow AI, a slight increase on 2025. Sources: IBM Newsroom; Cybersecurity Dive, Eric Geller.
Independent legal analysis of the same report puts the governance gap at 68 percent of breached organizations lacking policies to oversee AI use or manage shadow AI, and adds a sharper figure: 92 percent of organizations that suffered an AI-related breach lacked adequate AI access controls. That second number is the one worth pinning to a wall. The failure is rarely that nobody wrote a policy. It is that nothing enforced one. Sources: Alston & Bird Privacy, Cyber & Data Strategy Blog, Seol Namgoong and Kim Peretti.
Read the telemetry research and shadow AI looks like it is receding. Netskope's Cloud and Threat Report 2026, based on cloud security analytics from October 2024 to October 2025, found the share of generative AI users working through personal accounts their employer does not monitor fell to 47 percent, down from 78 percent a year earlier, while use of organization-sanctioned accounts rose to 62 percent from 25 percent. Sources: Cybersecurity Dive, Eric Geller; Netskope Threat Labs.
These findings are not in conflict, and reading them together is the point. Sanctioned AI absorbed most of the growth, while what stayed outside the perimeter got riskier. Netskope also recorded an average of 223 incidents of users sending sensitive data to AI apps per organization per month, roughly double the previous year. A falling percentage of a much bigger denominator is not a win yet. Meanwhile the share of users switching between personal and enterprise accounts rose from 4 percent to 9 percent. Those people are not resisting the sanctioned tool. They use it, then step outside for the one task where it fails them, which tells you where your approved tooling has a hole. Sources: Cybersecurity Dive, Eric Geller.
What actually leaks, ranked
Generic warnings about data exposure are less useful than the observed distribution. Netskope's Europe 2026 telemetry, reported May 27, 2026, breaks AI policy violations into categories: regulated data 59 percent of incidents, source code 15 percent, intellectual property 13 percent, passwords and API keys 12 percent. Sources: Help Net Security, on the Netskope Threat Labs Report: Europe 2026.
The ordering is the useful part. Most shadow AI messaging is built around source code and trade secrets, because those feel like the crown jewels. The measured leading category is regulated data, handled by employees who are not engineers and do not think of themselves as touching anything sensitive. Awareness training aimed only at engineering addresses 15 percent of the problem.
Passwords and API keys at 12 percent is the category that turns a privacy incident into an intrusion. OWASP lists sensitive information disclosure as LLM02 in its Top 10 for LLM Applications, with mitigations that are unglamorous and correct: sanitize inputs, enforce least-privilege access, restrict model access to external data sources, and tokenize or redact sensitive content. Sources: OWASP Top 10 for LLM Applications.
The 2026 shift: shadow agents, not shadow chatbots
Almost every explainer ranking for this topic describes shadow AI as an employee pasting text into a browser tab. That was accurate in 2024. It is now the mild case, and the distance between that framing and current reality is why security teams are surprised by what they find.
The change has a name. OpenClaw is a free, open-source autonomous agent that executes tasks through large language models and is driven from ordinary messaging apps. Austrian developer Peter Steinberger released it in November 2025 under a different name, it went through two renames by the end of January 2026, and by March 2, 2026 its repository showed 247,000 stars and 47,700 forks. It is not a chatbot in a tab. It runs on the employee's machine, holds their credentials, and acts. Sources: Wikipedia.
That capability is exactly the exposure. Cisco's AI security researchers published an analysis on January 28, 2026 noting that OpenClaw can run shell commands, read and write files, and execute scripts on your machine, citing research that 26 percent of 31,000 analyzed agent skills contained at least one vulnerability. Their own test of one third-party skill returned nine security findings, including data exfiltration to an external server without user awareness, a direct prompt injection to bypass safety guidelines, command injection through embedded bash, and tool poisoning. Sources: Cisco Blogs, Amy Chang, Vineeth Sai Narajala and Idan Habler.
The distinction that matters operationally is consent. A chatbot leak requires an employee to decide to paste something. A compromised agent skill does not. Data loss prevention rules watching what people type and upload are aimed at the wrong surface.
What the model providers actually do with the data, checked today
The most repeated line in shadow AI awareness material is that anything an employee pastes into a public AI tool becomes training data. As a blanket statement in August 2026 that is out of date, and repeating it costs credibility with the technical staff you most need to persuade. Anthropic's consumer privacy documentation, last updated March 16, 2026, states that consumer conversations are not used for training unless the user chooses to allow it, with narrow exceptions for safety review and opt-in programs, and that incognito chats are never used for training. OpenAI's API documentation states that data sent to the API is not used to train or improve its models unless the customer explicitly opts in, a commitment in place since March 1, 2023, with abuse-monitoring logs retained up to 30 days by default. Sources: Anthropic Privacy Center; OpenAI.
The honest version of the risk is different and stronger. Training is a settings question that varies by vendor, tier, and date. The durable problems with an unsanctioned personal account are the ones no toggle fixes: the data leaves your retention and deletion controls, sits in an account your legal team cannot preserve, is invisible to your audit trail, survives the employee's departure, and falls under consumer terms rather than your negotiated data processing agreement. Lead with those.
How to actually find shadow AI, and what each method misses
Detection is where most shadow AI programs quietly fail, because each common method sees a different slice and none sees the whole. The blind spots are worth naming before you choose.
| Method | What it sees | What it misses |
|---|---|---|
| Network and proxy logs | Traffic to known AI domains from managed devices | Personal devices, mobile data, local models, AI features inside approved SaaS |
| Cloud access broker or SSE telemetry | App inventory, volume, and inspectable session content | Unmanaged endpoints and anything routed around the agent |
| Endpoint detection | Locally installed AI apps and standalone agents on managed machines | Unenrolled devices and platforms not yet in the catalogue |
| Expense and procurement review | Paid subscriptions and team plans bought on cards or by departments | Everything on a free tier, where most shadow AI lives |
| Identity and OAuth grant review | Third-party AI apps connected to company mail, files, and chat | Tools used by copy and paste, which never request a grant |
| Asking people directly | Motivation, and the task the approved tool fails at | Anything staff think will get someone in trouble |
The tooling is arriving, with real limits attached
Platform vendors have started shipping shadow AI discovery as a product feature rather than a consulting deliverable. Microsoft's Shadow AI page in the Microsoft 365 admin center, documented June 12, 2026, gives administrators a dedicated view for detecting and governing unmanaged AI agents, showing first access date, most recent activity, device and unique user counts, and network traffic totals per agent. Sources: Microsoft Learn.
Read the constraints in the same document, because they define what you would actually get. The feature is in public preview under Microsoft's Frontier program. It needs Microsoft 365 E5 licensing. The traffic, user, and recency fields only populate if Global Secure Access is enabled. Detection covers a named list including OpenClaw, ChatGPT Desktop, Ollama Desktop, Poe Desktop, OpenCode, and Claude Desktop, but blocking is available only for OpenClaw, only on managed Windows devices enrolled in Intune, and the policy can take 15 minutes to 8 hours to propagate. Sources: Microsoft Learn.
What actually moves the number
The evidence supports a narrower set of interventions than most shadow AI programs attempt. Netskope's data is the strongest argument against the ban-first instinct: sanctioned account use more than doubled while personal account use fell, in a period when almost no organization successfully banned AI. People migrated to the approved tool because there was one and it worked. The 9 percent who switch between account types are telling you which task your sanctioned tool cannot do. That is a product backlog, not a disciplinary matter. Sources: Cybersecurity Dive, Eric Geller.
Fix access controls before writing more policy. With 92 percent of AI-related breaches occurring at organizations lacking adequate AI access controls, and governance adoption slipping rather than rising, another document is not the missing piece. Scoped identities, per-tool permissions, and enforced retention are. Sources: Alston & Bird Privacy, Cyber & Data Strategy Blog, Seol Namgoong and Kim Peretti.
Treat agents as a separate program with a separate inventory. Stanford HAI reports that formal AI agent deployment remains in the single digits across nearly all business functions, which is precisely the risk: official adoption is barely underway while the unofficial version has a repository with a quarter of a million stars. Sources: Stanford HAI; Wikipedia.
One pattern from the daily Roundup signal feed is worth stating as our own reading, not anyone's published finding. Through July 2026 the recurring enterprise AI story was visibility and unit economics rather than capability: buyers moved from asking which model is smartest to reading the bill, and vendors answered with spend analytics and per-employee usage limits. Separately, research across 107 enterprises found more than half had already had a confirmed agent incident or near-miss, while only about a third gave every agent its own scoped identity. Both threads are one story. Whoever can see per-person and per-agent AI usage can govern it. Everyone else is writing policy about a system they cannot observe.
What the rules already require
Shadow AI is usually filed under best practice. In the European Union, part of it is already law. Article 4 of the EU AI Act, applicable since February 2, 2025, requires providers and deployers to ensure, to their best extent, a sufficient level of AI literacy among staff and others operating AI systems on their behalf. That has an awkward implication: you cannot demonstrate your staff are sufficiently AI literate about systems you do not know they are operating. Discovery is not only a security control here, it is a prerequisite for evidencing compliance. Sources: EU Artificial Intelligence Act.
For the wider control set, our AI governance guide covers the frameworks and what they require, and our AI agent security guide covers identity, tool permissions, and approval design once agents run with real access.
Common questions
Is ChatGPT shadow AI? Only when used outside your organization's approval and visibility. The same product is sanctioned AI on a company account governed by your agreement and audit trail, and shadow AI on a personal login. The tool is not the variable. The account, the terms, and the visibility are.
What is an example of shadow AI? A salesperson pasting a customer list into a personal chatbot. A developer running a local model on an unenrolled laptop. A marketer connecting a third-party AI writing app to company Google Drive through an unreviewed OAuth grant. An engineer running an autonomous agent that reads their work mail. Only the first is caught by typical data loss prevention rules.
Why do employees use shadow AI? Overwhelmingly because the approved path is slower, absent, or worse at the task. The switching data supports this: the fastest-growing group is not the refuseniks but people who use the sanctioned tool most of the time and step outside it for particular jobs. Treat that as feedback on your tooling before treating it as a compliance failure. Sources: Cybersecurity Dive, Eric Geller.
What are the risks of shadow AI? In measured order: regulated personal, health, and financial data, then source code, then intellectual property, then credentials. Add loss of retention control, no audit trail, consumer rather than enterprise contract terms, and for agents, action on company systems that nobody logged. Sources: Help Net Security, on the Netskope Threat Labs Report: Europe 2026; OWASP Top 10 for LLM Applications.
Limits and uncertainty
This guide describes shadow AI as of August 10, 2026. The two strongest datasets behind it measure different things over different windows, which is why they point in different directions. IBM's figures come from 602 organizations that already suffered a breach, so they describe the population where something went wrong, not all organizations. Netskope's come from its own customers' cloud security telemetry, so they describe environments that already deployed inspection tooling and will tend to understate shadow AI elsewhere. Both are vendor research. We could not read IBM's report directly today because the publisher blocked automated access, so the shadow AI share and the governance gap are cited from Cybersecurity Dive's and Alston & Bird's reporting of it, and the frequently quoted average cost of a shadow AI breach is omitted because we could not verify it at a source naming its methodology. Microsoft's Shadow AI page is a public preview and will change. The reading of the Roundup signal feed is our own editorial synthesis, not a published study.