Answer box
Shadow AI is the use of AI tools, models, agents, and integrations inside an enterprise without security review or central visibility. It's not shadow IT, and it's not solved by the same controls. The Cloud Security Alliance's May 2026 Shadow AI Agents Report found 79% of organizations have no visibility into agent traffic leaving their environment, 76% confirmed active shadow AI in production, and the median Fortune 500 has 67 unsanctioned AI tools in active use. Most CISOs guess under ten. They haven't looked.
Why shadow AI is fundamentally different from shadow IT
If you're treating shadow AI as a 2014-style SaaS sprawl problem, you'll lose. Here's why the analogy breaks.
- Shadow IT was a tool-procurement problem. Shadow AI is a data-flow problem. When marketing bought Dropbox without telling you, the risk was a tool outside your identity perimeter. Containable. When marketing pastes a customer list into ChatGPT, the data is gone the moment they hit enter. Exfiltration isn't the next step. It is the step.
- Shadow AI doesn't need an install. It needs a tab. Shadow IT had a footprint — an app on a laptop, an OAuth grant, a credit card charge. Shadow AI hides inside browser sessions, embedded copilots inside SaaS you already pay for, and developer agents that spawn and terminate in minutes. The fingerprint your tooling was built to find isn't there.
- Shadow AI acts. Shadow IT mostly stored. A rogue Trello board didn't email your customers. A rogue agent will. Autonomous agents inside Cursor, Claude Code, and Replit can read your repo, call your APIs, push commits, file tickets, and message customers — often under a developer's personal credentials. The blast radius isn't a leaked spreadsheet. It's a system taking action on your behalf without anyone in your org knowing it ran.
The third point is the one boards haven't caught up to. The OWASP Top 10 for Agentic Applications 2026 spells it out: the unit of risk shifted from data at rest to actions taken. Your DLP wasn't built for that.
The five places shadow AI hides
If you're going to find it, you have to know where to look. Five surfaces, ranked by how often they get missed in a first audit.
1. Browser-based AI (the ChatGPT.com tab)
An employee opens chatgpt.com, claude.ai, perplexity.ai, or gemini.google.com, pastes context, gets an answer, closes the tab. No download. No OAuth. No log line saying "PII just left the building." The control gap: your network DLP sees an HTTPS POST to a known SaaS domain and waves it through. Your CASB has a "generative AI" category, but it's a coarse allow/block, not a prompt inspector. You don't know what was sent, only that something was.
2. Employee-installed browser extensions
Grammarly AI. Notion AI. A dozen Chrome extensions named "ChatGPT for Gmail" or "AI Sidebar for Slack." Each reads page content — including from your sanctioned apps — and ships it to a third-party model. The control gap: extensions live in the user profile, sync across devices, and bypass most endpoint controls. EDR sees a browser process, not an exfiltration channel.
3. SaaS-embedded AI (Copilot, Einstein, Workspace)
This one stings because you bought it. Microsoft 365 Copilot, Salesforce Einstein, Google Workspace Duet, ServiceNow Now Assist, Zoom AI Companion. All sanctioned. All also over-permissioned indexers that surface data your sharing policies were supposed to hide. We dug into this in the Microsoft 365 Copilot permissions breakdown — Copilot inherits effective access, not intended access, and the gap is where the leaks live. The control gap: it's not unsanctioned, so it doesn't show up in your shadow-IT report. But the prompts and outputs are governed by nothing.
4. Vendor APIs developers wired up without review
A backend engineer needs to summarize support tickets. They grab an OpenAI API key, drop it in an env var, ship a Lambda by Friday. No procurement ticket. No DPIA. No model card. The control gap: this looks like normal egress. Everything is "compliant" except the part where customer data is now training-eligible at a vendor your legal team has never heard of.
5. Autonomous agents inside developer tools
Cursor, Claude Code, Replit Agent, GitHub Copilot Workspace, Devin. Developers love them because they work. The agent reads the repo, runs commands, edits files, opens PRs, sometimes deploys. The control gap: agents run under the developer's personal MCP connections, API keys, and cloud credentials. No service account, no audit trail your SOC can pull. When an agent hallucinates a destructive command at 2 a.m., the only log is in the developer's terminal scrollback.
Why existing detection tools miss it
Your stack was designed for a different threat model. Here's the honest mapping.
| Tool category | What it catches | What it misses for shadow AI |
|---|---|---|
| Network DLP | File uploads matching regex patterns; large blob transfers to unknown destinations | Doesn't inspect prompt bodies; can't tell a question about Q3 revenue from a question about the weather; treats all HTTPS POSTs to chat.openai.com identically |
| CASB | Sanctioned SaaS posture, OAuth grants, API token sprawl | Doesn't see browser-resident chat sessions, doesn't catch embedded AI inside sanctioned SaaS, can't enumerate MCP servers a developer added locally |
| SIEM | Authentication, network, and endpoint logs from connected sources | No log source for "user pasted PII into a browser textarea"; AI API calls aren't tagged differently from any other outbound HTTPS |
| Endpoint EDR | Malicious binaries, suspicious process trees, privilege escalation | Doesn't model an agent process as risky; doesn't watch which MCP servers a developer's IDE is calling; treats Cursor like VS Code |
| SaaS posture (SSPM) | Misconfigurations in known apps | Doesn't catalogue the long tail of AI apps (we currently track 1,400+); blind to extensions and to model-level settings inside Copilot-class products |
None of these tools are broken. They were built for a world where data left via known channels. Shadow AI created new ones — prompt fields, extension contexts, agent runtimes — and your detection layer never grew an inspection point for any of them.
What detection actually requires
If you accept the diagnosis, the requirements get specific. Five capabilities — you probably have zero today.
- Browser-resident discovery. Not a network signature. A presence check inside the browser — what AI surfaces are open, what extensions are loaded, what models the user authenticated to. This is where the ground truth of "is my employee using an AI right now" actually lives.
- Prompt-layer inspection. The unit of risk is the prompt, not the packet. You need to read what's being sent — with redaction, policy, audit — before it leaves. A regex pass on outbound traffic doesn't qualify; the content is natural language, often paraphrased.
- MCP server inventory. The Model Context Protocol is now how most agentic tools connect to data sources. Every developer running Claude Code or Cursor has an mcp.json listing the servers their agent can call. You need a continuous inventory across your fleet. Most CISOs we ask have never opened one.
- An AI-tool catalogue with provenance. Knowing the domain isn't enough. You need to know who runs the model, where data is processed, whether terms allow training, and what jurisdiction the inference happens in. We maintain 1,400+ apps with these fields populated. Build your own, but budget a quarter of analyst time.
- Continuous monitoring, not point-in-time scans. The half-life of a shadow AI inventory is roughly two weeks. A quarterly audit is theatre. Gartner's 2025 AI TRiSM market guide makes the same point in less direct language.
Want a number to anchor this for your board? Our AI agent risk calculator converts headcount, sector, and control posture into an exposure estimate. Not a substitute for an audit, but enough to walk into the next risk committee with.
The remediation playbook — three weeks
Three weeks, not three quarters. Anything longer and the inventory you started with is already stale.
Week 1: inventory
Deploy browser-resident discovery to a representative slice — usually engineering, sales, and one corporate function (HR or finance). Pull MCP configs from developer endpoints. Cross-reference SaaS spend against your AI catalogue. The deliverable: a list, with owners, of every AI surface in use. Expect 3–5x what your team guessed.
Week 2: risk-classify
Three buckets. Sanctioned and governed (you bought it, you have a DPA, you configured it). Sanctioned but ungoverned (you bought it, nobody set the controls — this is where Copilot lives in most enterprises). Unsanctioned (everything else). Then layer data sensitivity: which tools touch regulated data, customer PII, source code, deal terms. Don't score 1–10. Three tiers is plenty.
Week 3: enforce policy — or sanction with controls
This is where most enterprises stop, and it's the wrong place to stop. The instinct is to publish a block list and call it done. That buys a week of compliance theatre, then employees route around it. The unlock is the second move: sanction with controls. Take the top five tools your workforce actually wants. Negotiate enterprise terms. Configure controls (prompt redaction, no-training flags, retention, SSO). Publish them as the approved path. Now the productivity gain is captured and the exposure is bounded. For a side-by-side on how the two leading SaaS-embedded options handle data, see our Copilot vs. ChatGPT Enterprise data leakage comparison.
What boards will start asking in 2026
The board questions are changing fast. If you can't answer these by your next audit committee, you're behind.
- "What's our current list of unsanctioned AI tools, and when was it last updated?" If the answer involves a spreadsheet older than 30 days, you don't have a program. You have an artifact.
- "Which employees sent PII or customer data to a non-enterprise AI tool in the last 90 days, and what was the data?" This is the question your audit committee will ask after the first public shadow-AI breach lands in the trade press. The first time you hear it shouldn't be in that meeting.
- "When was our last shadow-AI scan, who ran it, and what did we do with the findings?" The Ponemon Institute's 2024 Cost of a Data Breach Report pegs the average breach at $4.88M. Shadow AI breaches skew higher — a single prompt can carry what would've taken a malicious insider weeks to exfiltrate the old way. Boards know this number.
For the broader landscape, see our shadow AI pillar page.
FAQ
How is shadow AI actually different from shadow IT?
Shadow IT was about tools outside your perimeter. Shadow AI is about data leaving it. With shadow IT, the data was at risk because the tool wasn't governed. With shadow AI, the data is gone the moment it's typed into a prompt — no recall, no rollback, often no log. Same word, fundamentally different problem.
Who owns shadow AI in the org?
Today, it falls between three desks: CISO (security), CIO (procurement), and increasingly CDO or Chief AI Officer (model governance). What most teams get wrong is treating it as a single-owner problem. The working pattern: CISO owns detection and policy, CIO owns sanctioned-path delivery, CDO owns model-level controls. No CDO? The CISO owns all three by default.
Can you ever fully eliminate shadow AI?
No. And you shouldn't try. The goal isn't zero — it's a known, bounded shadow with a fast funnel from "unsanctioned" to "sanctioned with controls." A mature program assumes new shadow AI shows up every week and has a 14-day path to either block or sanction. Programs aiming for zero end up with employees on personal devices and your detection in the dark.
What's the cost of doing nothing?
Three layers. The headline breach — Ponemon's $4.88M average, higher in regulated industries. The regulatory tail: EU AI Act, NYDFS AI guidance, and the SEC cyber disclosure rule all read on AI-specific controls now; "we didn't know" stops being a defense. And the slower cost — the productivity ceiling. Broad bans don't stop AI use; they just forfeit enterprise terms. The cost isn't a future incident. It's the gap between competitors' AI-enabled output and yours, compounding daily.
How does AccuroAI catch what network DLP can't?
Three layers your DLP doesn't have. We sit inside the browser, so we see prompts before they leave — text, file uploads, paste events. We inventory MCP servers and agent runtimes on developer machines, so we know what your Cursor and Claude Code installs can reach. And we maintain the 1,400+-app catalogue with vendor provenance, so when a new tool shows up, we can tell you who's behind it. Net effect: you see the prompt, the agent, and the destination — the three things every existing tool in your stack is blind to.