77% of employees have pasted sensitive company data into generative AI prompts (LayerX Enterprise AI Security Report 2025)

What is shadow AI?

Shadow AI is people using AI without the visibility of their IT or cybersecurity teams.

Why is shadow AI a problem?

The problem is not that they use AI, the problem is that they use free, unapproved AI platforms and plugins. If you as the business owner or your IT team, are not aware of what your staff are using, you can’t track or record where your data lives for your compliance audits.

Why are employees using unapproved AI tools?

There are two main reasons are:

• Businesses don’t have approved AI tools or are taking too long to authorise their use
• Employees use tools to speed up their workflow without realising the risks

How does shadow AI give hackers a hidden backdoor into your business

AI tools like Claude or ChatGPT do not require lengthy or complex setups. Therefore, it’s easy for employees to start using them and bypass controls that approved tools wouldn’t. This means they can stay undetected for a long time, until a breach occurs.

Risks of using unapproved AI:

Data Leaks

APIs allow employees to integrate the AI tools into their regular workflows. Using them without oversight could lead to the sharing of sensitive data, which hackers can use as leverage to demand ransom or sell on the dark web.

Coding Bugs

If your teams use AI to write code, they could introduce bugs into the output. Hackers could later use these to compromise entire systems.

Regulatory Compliance Risk

The UK GDPR stipulates that every organisation that collects, processes and handles customer data must use it for the intended purpose. Using this information outside the agreed scope or sharing it with outsiders could result in hefty fines from the ICO.

It is important to remember that your business will be liable whether employees shared the data using an approved tool or not.

Prompt Injection

AI models do not separate data and code, making it easy for cybercriminals to use malicious instructions to trick a system into bypassing rules. This permits them to access sensitive information.

Plugin Flaws

Some AI plugins are not secure. When employees add them to their daily operations, malicious actors lie in wait and use them to strike.

Inaccurate Output

Is your finance team using AI tools like ChatGPT to analyse financial data? These could return erroneous output. When these errors go unchecked, they can trigger negative effects on your business, such as:

• Incorrect resource allocation
• Unreliable projections
• Financial losses
• Reputational damage

OAuth Token and API Abuse

Connecting AI tools to corporate systems could give them broad access without requiring authentication (OAuth). Attackers can later use these tokens to infiltrate systems.

What attackers can see when employees paste sensitive data into unapproved AI tools?

When employees enter sensitive company information into AI, organisations no longer have control over how the tools use it. They may decide to train their models with it or, worse, to launch cyberattacks.

Examples of what hackers can see are:

• Product road maps
• Proprietary source code
• Financial data
• Customer data

Real breaches that started with a single ChatGPT prompt

OpenAI confirmed that a cybercriminal gained access to Mixpanel, a third-party analytics firm, last year. Although the hacker only managed to steal a section of its data, it is evident that unvetted AI tools are capable of causing serious harm if left unchecked.

Security researchers have also uncovered ChatGPT vulnerabilities that could help attackers infiltrate your systems, such as:

• Malicious prompts that could hide malicious channels in regular conversations
• OpenAI connector weaknesses that could extract data from a user’s Google Drive

Warning signs your company data is already being harvested through shadow AI

Traffic Flow During Off-hours

Have you noticed traffic from your systems outside of working hours? Your systems have already been infiltrated.

Unusually High Database Reads

This could suggest that a hacker has used a script or an AI agent to steal your data.

Authentications Outside Your Country

Any outbound logins outside your geographic region show that a cybercriminal could be watching your systems.

Too Many Access Requests to Sensitive Files

Have you noticed too many attempts to access important data? Review this immediately, as a cybercriminal could be trying to get into your systems.

Unauthorised Configuration Changes

Hackers use unapproved AI to configure servers, files and devices. This makes it easier for them to gain unauthorised access later on. This also leaves your business vulnerable to malware exploits.

How to detect and shut down shadow AI before a hacker does

Unapproved AI is not easy to detect. The good news is that there are many signs that your staff could already be using it.

How to tell if your staff is already using Shadow AI

Sudden Productivity Spikes

Has your team’s productivity suddenly skyrocketed? The chances that your employees are using AI tools are high.

Traffic That Points to AI Domains

Check your traffic logs to find AI extensions your IT team hasn’t approved. Examples here are:

• Api.openai.com
• Claude.ai
• Gemini.google.com

Too Many Copy-paste Patterns

Another great indicator that your employees are using unapproved AI tools is when your endpoint telemetry shows too much copy-pasting of information to browsers.

AI Platform Registrations Using Work Emails

Scan your corporate email metadata. Does it show welcome emails, resets or account confirmations to unreviewed AI tools? Your workers have used their work emails for registration.

What to do after you realise your employees are using shadow AI?

Introduce an AI Policy

Create a clear and accessible AI policy that states the following:

• The tools your company has approved
• The type of data your team should never use with AI tools

Provide an AI Alternative

Completely shunning AI could lead to employee disengagement or cause them to devise other ways of using the technology without your security team’s knowledge. So, introduce a suitable tool like Microsoft Copilot that will also be visible to your IT department. This will ensure it’s governed and will make it easier to spot risks and mitigate them before they cause irreparable damage.

Train Your Staff

Most workers use unapproved tools because they are unaware of the risks they pose to businesses. Therefore, empower them with the right knowledge so they can know why they shouldn’t use them.

If anything in this article has raised concerns or more questions, book a meeting with Simon.