Skip to content
redactsure
Book a demo

Explore.

Explainer · By Chris Sowa · Published
Last updated

What Is Shadow AI and Why Is It So Hard for Security Teams to See?

Shadow AI is the use of AI tools, accounts and agents on an organization's work and data without the knowledge or approval of the people responsible for security. It is hard to see because it arrives through ordinary browsing, personal accounts and free tiers, and leaves no file behind. Unmeasured, it is a data flow the organization cannot audit.

Browser activity passes a boundary into cloud AI services along a controlled record stream.

Shadow AI is the use of AI tools, accounts and agents on an organization's work and data without the knowledge or approval of the people responsible for security. It is hard to see because it arrives through ordinary browsing, personal accounts and free tiers, and leaves no file behind. Unmeasured, it is a data flow the organization cannot audit. The question matters now because the tools have changed shape. In 2023 shadow AI was a chat window and a paste. In 2026 it includes always-on agents with their own cloud computers, browser extensions that read the open tab, and small-business agents wired into accounting and payment systems, free to whoever signs up. The question security teams ask of any delegated work applies to a personal ChatGPT account as much as to an approved deployment: what should the AI see for this piece of work? The answer is Least Exposure: for each piece of work, the AI receives exactly the data the task requires and nothing more, enforced before any model reads the screen. The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Key findings

  • More than half of people worldwide say AI products make them nervous, yet use keeps rising, with ChatGPT reaching a billion monthly users (MIT Technology Review, 2026).
  • McKinsey's State of AI 2026 reports 62 percent of organizations experimenting with AI agents and 23 percent scaling them anywhere (CX Today, 2026). The gap between the two numbers is where shadow AI lives.
  • OWASP ranks Sensitive Information Disclosure second in its 2025 Top 10 for LLM applications, as LLM02, behind only Prompt Injection (OWASP, 2025).
  • OpenAI's dots each have "its own cloud computer and browser" and can connect to more than 4,000 apps through plugins, with the first dot free in Pro and Business Premium plans (The Next Web, 2026).
  • Gartner finds that applying uniform governance across AI agents will lead to enterprise AI agent failure (Gartner, 2026), which cuts against the one-size ban.

What is shadow AI?

Shadow AI is the AI counterpart of shadow IT: technology used for work that the organization did not select, contract for, configure or monitor. It covers any model, assistant or agent that touches work data outside that governance. The defining feature is not that the tool is bad; most are mainstream products. It is that nobody responsible for security knows the tool is in use, what it has been shown, or what it has done. Three forms recur.

Form What it looks like What the organization cannot see
Unsanctioned tool An employee pastes a customer email or a patient note into a personal chatbot account The content that left, the account it went to, the retention terms
Sanctioned tool, unsanctioned use An approved assistant is used on data its approval never covered, such as a spreadsheet of account numbers The data category that reached the model, and whether the approved contract covers it
Shadow agent An agent with its own browser or cloud computer is connected to work systems by an individual Every screen it read, every action it took, who approved them

The first form is the one most policies were written for. The second is more common than security teams expect, because approval attaches to a product, not a task; an assistant cleared for marketing copy is the one the finance team opens on Monday. The third form is new and has its own page. An agent does not only read; it acts, and the action can be a sent message, a changed record or a payment no named person reviewed.

A working definition for a security program: shadow AI is any AI use on work data for which the organization cannot answer three questions. What did the model receive? What did it do with it? Who approved that? The same product can be governed in one team and shadow in the next.

Why do employees use AI the organization did not approve?

The answer is not recklessness. MIT Technology Review reported in October 2026 that more than half of people worldwide say AI products make them nervous, and that a May Gallup poll found 71 percent of US adults would oppose a new AI data center in their area, against 53 percent for a new nuclear plant (MIT Technology Review, 2026). In the same period ChatGPT reached a billion monthly users (MIT Technology Review, 2026). The people using these tools at work are largely the people who tell pollsters the tools make them uneasy, and they use them because the tools finish the task.

The organizational side of the explanation is the scaling gap. McKinsey's State of AI 2026 found 62 percent of organizations experimenting with AI agents and 23 percent scaling them anywhere (CX Today, 2026). An employee in one of those organizations sees a pilot that has not reached their desk and a free tool that has. Waiting costs them every day; the risk of the unapproved path is abstract and borne by someone else.

The third driver is packaging aimed at the individual. The first OpenAI dot is free in Pro and Business Premium plans, and each has its own cloud computer and browser (The Next Web, 2026). Muse for Small Business is free with usage limits and connects to Shopify, Stripe, Intuit QuickBooks and Slack (TechCrunch, 2026). Neither needs a procurement cycle, a security review or an IT ticket. A policy that assumes software enters through purchasing will not see software that enters through a sign-up form.

Why is shadow AI hard for security teams to see?

Security tooling was built to see files crossing boundaries and devices joining networks. Shadow AI does neither in a form the tooling recognizes. Five properties hide it.

It looks like browsing. A paste into a chatbot is an HTTPS request to a well-known domain, indistinguishable at the network layer from reading the news. Proxies can categorize the domain, but the category "AI" now includes the search engine, the office suite and the email client; blocking it breaks sanctioned work and allowing it admits everything.

There is no artifact. Data loss prevention inspects attachments, uploads and removable media. The shadow AI event is a text field: the content exists in the browser for a moment, is sent, and is gone from the endpoint, with the only lasting copy held by the vendor under a personal account's terms. The agent variant is worse: Claude in Chrome screenshots the active tab, and Anthropic's guidance states that all visible information, including personal data, becomes part of the context (Claude Help Center, 2026). A screenshot of a records screen is the whole screen.

The identity is personal. A worker signs in with a personal email address, so single sign-on and the identity provider show nothing, and the enterprise agreement with the same vendor does not apply. The data went to a vendor the organization has a contract with, under terms the contract does not govern.

The compute is elsewhere. An agent with its own cloud computer runs on the vendor's infrastructure, not the employee's laptop (The Next Web, 2026). Endpoint agents and device management see the device, not a browser session in a vendor's data center that the employee connected to work systems with saved credentials. The only trace is a login from an unfamiliar address that looks like the employee.

Once data is inside a model's context, tracing where it went is an open research problem. Siddiqui and colleagues propose information-flow labels to track which inputs influenced which outputs, research that exists because no settled method does (Siddiqui et al., 2025). A security team cannot reconstruct afterward what a model was shown if the showing was never recorded. Visibility has to be designed in before the run.

What does shadow AI expose?

Three kinds: the data shown, the action taken, and the record that does not exist.

The data shown is the familiar case. OWASP's LLM02 describes sensitive information disclosure as the risk that an LLM reveals, or is given access to, data it should not hold (OWASP, 2025). In the shadow case the "given access to" clause does the work. A clinician summarizing a discharge note, an adjuster drafting a denial letter, a registrar reconciling enrollment, each hands the model a screen with the dates, amounts and codes the task needed and the names, SSNs and account numbers it did not. Whether that transfer created a reportable event under HIPAA, FERPA or a state privacy law is a determination for counsel, and one the organization cannot begin if it does not know it occurred.

The action taken is the agent case. An agent that reads a web page, an email or a document can be redirected by instructions hidden in that content, the indirect prompt injection Greshake and colleagues demonstrated against real LLM-integrated applications (Greshake et al., 2023), and OWASP lists prompt injection as LLM01, the top risk (OWASP, 2025). A sanctioned agent in a governed environment meets that attack with controls outside the model. A shadow agent meets it with the vendor's consumer settings, under an account the organization does not administer.

The record that does not exist is the exposure auditors feel first. When an approved workflow goes wrong, the organization can produce what the system received, what it did and who approved it. When a shadow workflow goes wrong, there is a personal account, a vendor activity view the organization cannot reach, and changed records with no approval attached. The question a regulator asks, who decided this, has no answer.

Does banning shadow AI make it visible?

No. A ban produces invisibility, not safety (Does Banning AI Tools Stop Employees Using Them?). The ban removes the sanctioned path, and its users move to the unsanctioned one, where the organization has no logs, no contract and no retention terms. The polling explains why: the workforce already distrusts the tools and uses them anyway (MIT Technology Review, 2026).

The UK's National Cyber Security Centre treats shadow AI as a species of shadow IT, met by understanding why people reach for unapproved tools and providing approved alternatives rather than by prohibition alone (NCSC, 2026). Gartner's finding that uniform governance across agents leads to failure points the same way: one rule for every AI use, whether "nothing" or "anything," fits none of the actual tasks (Gartner, 2026). Governance that fits the task is harder to write and easier to follow.

The alternative to a ban is an amnesty followed by a path. The amnesty asks people to declare what they use and on what, without penalty (how to run one). The path gives them a governed way to do the same work, with the identifiers the task never needed kept from the model and a named person on every consequential action. People move when the governed path finishes the task as well as the shadow one did.

How should a security team make shadow AI visible?

The NIST AI Risk Management Framework's Map function asks an organization to inventory the contexts in which AI is used and the data each touches (NIST, 2023). For shadow AI, that inventory cannot come from the procurement ledger. Three sources together approximate it.

Source What it reveals What it misses
Network and proxy logs Which AI domains receive traffic, from which devices, how often Personal devices, agents on vendor cloud computers, what was sent
Identity and SSO records Which enterprise accounts exist with AI vendors Personal accounts, which are the shadow case by definition
Amnesty and interviews Which tools people use, on which tasks, with what data Anything people forgot or chose not to mention

None of the three answers the question that matters most: what the model received. That comes only from a control placed before the model reads the data, which records what it showed and withholds what the task did not need. Least privilege does not supply it; the account that pasted the customer record was entitled to open it. The missing decision is not who may open the record but what, within it, the AI should be shown.

A sequence follows. First, measure: run the three sources and treat the result as a floor. Second, decide per task which fields the model needs and which identifiers it does not. Third, provide the governed path for the highest-volume workflows first. Fourth, keep the record: every screen the model was shown, every action, every approval with a name, exported to the organization's own monitoring. An organization that can produce that record for a workflow no longer has a shadow problem there; it has an audit entry.

Where does RedactSure sit?

RedactSure provides the governed path the shadow path competes with. Inside its environment, every identifier chosen by policy (names, SSNs, MRNs, account and card numbers, dates of birth) is replaced by a consistent token at the render layer before any model reads the screen: render-layer tokenization. The model receives the task's fields with SSN_001 and ACCT_001 in place of the real values; amounts, dates and codes stay in clear. The Planner sets which values are tokenized and what the agent may do on each screen; under Supervised Delegation, a named person confirms that policy before the run and approves every payment, submission and record change while it runs. Real values resolve only at approved destinations at the moment of an approved action.

Every screen as tokens, every action and every approval with a name lands in the AI Control Record and exports to the customer's SIEM, the record the shadow path never produces. The environment runs in the customer's cloud with keys the customer holds, with no per-application integration, no change to user permissions, and any vendor's model. Deployments are in pilot. Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

This page is a definitional synthesis from sources read as of October 13, 2026. Survey and adoption figures come from industry analysis and press: MIT Technology Review's October 2026 reporting on public attitudes to AI, CX Today's report of McKinsey's State of AI 2026 and Gartner's May 2026 press release on agent governance. Product facts about OpenAI dots, Muse for Small Business and Claude in Chrome come from press coverage and vendor help documentation, dated as cited. Standards and guidance are OWASP LLM01 and LLM02 (2025), the NIST AI Risk Management Framework and UK NCSC guidance. Research citations are to Greshake and colleagues on indirect prompt injection and Siddiqui and colleagues on information flow through models.

No product was tested. No proxy logs, identity records or amnesty results were examined, and no measurement of shadow AI prevalence is reported, because the sources consulted report attitudes and adoption rather than unsanctioned use. Vendor features and free allowances change; the page carries its date and is revised when the sources change. The clinician, adjuster and registrar examples describe kinds of work, not any organization; no customer or prospect is described. Statements about RedactSure are limited to the design facts the company publishes about itself.

Whether a given instance of shadow AI use created a reportable event or violated HIPAA, FERPA, PCI DSS or a state privacy law is a determination for the organization's counsel, assessor and security and compliance officers, who hold the facts. The frameworks cited set out practices; they do not decide any case.

What the record shows

Shadow AI is the gap between the work people need done and the governed way to do it, filled by whatever free tool reaches the worker first. It is invisible because it moves through browsing, personal accounts and vendor-hosted computers, which the security stack was not built to watch, and because once a model has read a screen, nothing in the logs says what it read. A ban widens the gap. The test a reader can apply is one question for one workflow: can the organization produce, for the last time an AI touched it, what the model was shown, what it did and who approved it? Where the answer is no, that workflow is shadow AI, whatever the policy says.

Frequently asked questions

Is shadow AI the same as shadow IT?

It is a subset with a sharper edge. Shadow IT covers any unapproved technology used for work; shadow AI is the part where a model reads work data and, increasingly, acts on work systems. A shadow file-sharing account holds copies; a shadow AI account has processed the content, and a shadow agent may have changed records with no named approval.

Does an enterprise contract with an AI vendor end shadow AI?

No. The contract governs the enterprise accounts. An employee who signs in to the same vendor with a personal address is outside it, under terms the organization did not negotiate. The contract also does not decide what the model is shown on each screen; an approved tool used on data its approval never covered is shadow use under a license.

Why does blocking AI domains at the proxy not solve it?

Because the category no longer separates. The same domains serve the search engine, the office suite and the assistant, so blocking by category breaks sanctioned work and allowing it admits everything. A proxy also cannot see an agent on the vendor's cloud computer that connects to work systems with saved credentials; that traffic never crosses the network.

What is the first thing a security team should do about shadow AI?

Measure, without penalty. Combine proxy logs, identity records and an amnesty, and treat the result as a floor. Then pick the highest-volume workflow that surfaced and provide a governed way to do it, with the identifiers the task never needed kept from the model and a named person approving each consequential action.

Can an organization find out what a shadow AI tool was shown after the fact?

Rarely. The content lived in a browser text field and then in a vendor's context window under a personal account. Research on tracking information flow through models is active because no settled method exists, so visibility has to be designed in before the run, with a control that records what the model received.

Is a shadow AI agent more dangerous than a shadow chatbot?

Yes, on two counts. The agent reads whole screens rather than pasted fragments, so it receives every identifier on the page, and it acts, so a hidden instruction in content it reads can become a sent message, a changed record or a payment with no person approving. A chatbot leaks what it was given; an agent acts on it.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.