Answer box
Shadow AI is the use of AI tools (ChatGPT, Claude, Copilot, Gemini, Perplexity, browser plugins, coding agents, MCP servers) by employees or autonomous agents without explicit IT or security sanction. The average enterprise runs 67 generative AI tools, nearly 90% of them without corporate approval (Prompt Security, 2024). 1 in 3 employees pastes sensitive data into public LLMs weekly. <12% of AI traffic is visible to security teams. This hub is the canonical entry point: definitions, the data, the discovery methods, the controls, and every AccuroAI post on the topic.
The numbers that matter
- 67 generative AI tools in the average enterprise, nearly 90% of them unapproved (Prompt Security, 2024).
- 82% of organizations discovered previously unknown AI agents in the past year, and 41% said it happened more than once (CSA, April 2026).
- 65% had at least one AI agent-related incident in the past year, and only 21% have a formal process for decommissioning agents (CSA, April 2026).
- 47% of AI use bypasses SSO.
- 67% of executives believe their company has already had a leak via unsanctioned AI (Writer 2026).
- $5.39M average cost of a breach involving shadow AI (IBM Cost of a Data Breach 2026).
- 94% shadow-AI reduction achievable in 30 days with the right control plane (AccuroAI customer benchmark across 15 enterprises).
What "shadow AI" actually includes in 2026
The category has expanded substantially:
- Consumer-tier LLM accounts: ChatGPT Plus / Team, Claude Pro, Gemini Advanced, Perplexity Pro used personally.
- Public-tier model use via API, direct API calls from internal code paths.
- Browser-based AI extensions: Grammarly, QuillBot, Glasp, summarizers, "AI co-pilots" in browser context.
- Coding agents: Cursor, Cline, Continue, Windsurf, Codex CLI, often connected to public model APIs.
- MCP servers, local processes that bind to localhost / random ports and expose tools to any agent that asks. See the MCP enterprise inventory playbook.
- Custom GPTs and agent assistants built by employees on consumer-tier infrastructure.
- Vendor-bundled AI inside SaaS: Salesforce Einstein, Notion AI, Slack AI, etc., enabled without governance review.
- AI used by autonomous agents that you've sanctioned for one purpose but which then call additional AI services on their own.
How shadow AI is discovered
| Discovery surface | What it sees | Strengths | Limits |
|---|---|---|---|
| Browser sensor | Browser-tab activity to AI URLs | Catches consumer LLM use | Requires extension or browser fleet management |
| Network egress | DNS / IP / SNI for AI provider endpoints | Catches API calls | Encrypted traffic limits depth; doesn't catch local MCP |
| Endpoint telemetry | Child processes, file modifications | Catches local MCP, coding agents | Requires endpoint agent |
| SaaS API / OAuth | OAuth grants to AI services | Catches connected GPTs and apps | Misses inline browser AI use |
| Identity provider logs | SSO / login activity to known AI tools | Catches sanctioned-tier accounts | Misses consumer accounts not via SSO |
| CASB / SSE | SaaS app traffic | Mature integration story | Coverage of AI specifically depends on vendor |
A complete shadow AI discovery program uses 3-4 surfaces concurrently. See our AI Visibility Tool with SAML SSO buyer's guide and Workforce AI Security Buyer's Guide for the multi-surface evaluation framework.
The control playbook
A 4-phase program:
- Discover. Multi-surface scan. Inventory by tool, user, frequency, sensitivity.
- Classify. Each tool risk-scored on data sensitivity, backend reach, auth, supply chain. Categorize: sanction, sanction-with-controls, review, prohibit.
- Govern. Apply inline inspection on sanctioned tools. Block prohibited tools at the egress / browser layer. Re-route to sanctioned alternatives.
- Sustain. Re-discover continuously. Shadow AI regrows weekly. Re-baseline monthly.
All AccuroAI posts on shadow AI
Foundation
- Shadow AI: The Hidden Risk Your Security Team Is Probably Ignoring, the introductory framing piece.
- Shadow AI Data Leakage: Employee Sensitive Data Risk, what gets leaked and how.
- Shadow AI Is a Board-Level Threat, the modeled exposure per incident and the evidence to bring to the board.
Per-platform deep dives
- Microsoft 365 Copilot Oversharing, the M365 permissions sprawl pattern.
- Microsoft 365 Copilot Permissions: What's Official, What's Inherited, What Leaks, the official-source reference.
- Microsoft 365 Copilot vs ChatGPT Enterprise: Where Each Leaks, side-by-side leak profiles.
Detection and governance
- AI Visibility Tool with SAML SSO: A 2026 Enterprise Buyer's Guide, the discovery + access-control combo.
- Workforce AI Security: A 2026 Buyer's Guide, the broader workforce-side category.
- MCP Server Security: The Enterprise Inventory Playbook, discovery for the MCP-specific surface.
Strategic
- The Seven Questions Your Board Will Ask About AI Risk in 2026, board-level shadow AI framing.
What to do this quarter
- Run discovery across at least 3 surfaces (browser, network, endpoint, or SaaS).
- Score the top 20 unsanctioned tools against the 5-dimension rubric in the MCP inventory playbook.
- Choose sanction-with-controls for the top 10 high-value tools.
- Block / re-route the highest-risk shadow tools at the browser or egress layer.
- Brief your AI risk committee with the inventory and the trajectory.
Two things make that quarter plan concrete. If you need a number to take into a budget conversation, our AI agent risk exposure calculator sizes the gap from your own headcount and tool estimates. If you need the sequence rather than the number, the enterprise AI security playbook runs discovery through enforcement in the order the work actually has to happen.
FAQ
What is shadow AI? The use of AI tools by employees or autonomous agents without explicit IT or security sanction. Includes consumer LLM accounts, browser AI extensions, coding agents, MCP servers, and unsanctioned SaaS AI features.
Why is shadow AI a problem? It bypasses your data-handling controls. Sensitive data reaches external model providers, often without contractual data-handling protections. It also bypasses identity, audit, and compliance evidence requirements under NIST AI RMF, ISO 42001, and EU AI Act.
How do I discover shadow AI? Multi-surface scan: browser sensor, network egress, endpoint telemetry, SaaS OAuth grants, identity provider logs. No single surface catches everything.
Is blocking shadow AI a good answer? Rarely as a sole control. Employees route around blocks. The more sustainable answer is sanction-with-controls for the high-value tools, block-and-route for the high-risk tools, and continuous re-discovery.
Does Microsoft Purview AI Hub solve shadow AI? For Microsoft Copilot specifically, yes, to an extent. For the broader shadow AI surface across consumer LLMs, browser AI extensions, MCP servers, custom GPTs, it does not. See the Copilot permissions piece.
Sources: Cloud Security Alliance — Autonomous but Not Controlled (April 2026) · Writer — Enterprise AI Adoption 2026 · Help Net Security — CSA AI Security Governance.