Shadow AI

The Hidden Attack Surface Your Security Program Isn’t Watching

The Ungoverned Layer

Security teams spent the last decade wrestling shadow IT into submission. A more dangerous successor is now everywhere in your environment — and most of your controls do not see it at all.

Shadow AI is not a buzzword for “too much ChatGPT.” It is the unsanctioned, largely invisible layer of AI tools, assistants, and increasingly autonomous agents that employees have already woven into their workflows without security review, governance, or real telemetry. It quietly inflates breach costs, contaminates codebases, leaks regulated data into black-box models, and reshapes your attack surface in ways your current risk framework was never built to capture.

If you are a CISO, security leader, or defender responsible for protecting an AI-enabled business, Shadow AI is not a future concern. It is here now. The only question is whether you can see it — and whether you are willing to treat it as a first-class security problem rather than a productivity experiment.

What Shadow AI actually is

The definition needs to be precise: Shadow AI is the unsanctioned use or implementation of AI tools, models, or agentic systems inside an organization that operate outside formal IT and security oversight. In practice that means employees pasting code, logs, and customer data into external assistants without approval; team-level adoption of generative-AI SaaS that procurement and security never reviewed; “side-project” LLM apps built with vibe-coded architectures and pointed at production data; and agentic workflows wired into CI/CD pipelines with no threat model behind them.

The comparison with shadow IT is useful but incomplete. Shadow IT was mostly about unmanaged infrastructure and SaaS. Shadow AI is about unmanaged cognition — prompts, training data, generated code, autonomous agents, and decision chains that live both inside and outside your perimeter, and that can act on your behalf.

The economics are no longer theoretical

For years, the case against Shadow AI rested on intuition. That changed in 2025. IBM’s twentieth annual Cost of a Data Breach Report, conducted by the Ponemon Institute across 600 organizations breached between March 2024 and February 2025, was the first to isolate Shadow AI as a distinct breach factor — and the findings are stark.

• One in five breached organizations — 20 percent — suffered a breach involving Shadow AI.

• Organizations with high levels of Shadow AI paid roughly $670,000 more per breach than those with little or none, making it one of the three costliest breach factors of the year and displacing the security skills shortage on that list.

• 97 percent of organizations that reported an AI-related breach lacked proper AI access controls.

• 63 percent of breached organizations either had no AI governance policy or were still drafting one; among those that had a policy, only about a third ran regular audits for unsanctioned AI.

• Shadow AI breaches disproportionately exposed customer PII (65 percent versus a 53 percent global average) and intellectual property (40 percent versus 33 percent), with the compromised data most often scattered across multiple environments.

There is a mirror image to these numbers worth holding onto. In the same dataset, organizations that used AI and automation extensively in their defense averaged $3.62 million per breach against $5.52 million for non-users — a difference of nearly $1.9 million — and shortened the breach lifecycle by an average of 80 days. AI is not the enemy. Ungoverned AI is.

Why it outran governance

When you talk privately with developers, analysts, and product teams, a consistent story emerges: the organization’s appetite for AI far exceeds its governance maturity. Three forces drove that gap open.

Frictionless access. Anyone with a browser and an email address can integrate world-class AI into their daily work — no VPN, no procurement cycle, no architecture review. The distance between “I wonder if AI can help with this” and “I am now feeding sensitive artifacts into a chatbot” is measured in seconds.

Productivity pressure. Teams are told, explicitly or implicitly, that AI is the new productivity multiplier. If security cannot provide safe AI paths quickly, employees build their own. Shadow AI is often less rebellion than survival.

Immature controls. Most organizations still lean on policy and awareness training as their primary AI control layer, while real telemetry on AI usage is thin or nonexistent. Policy says “do not paste sensitive data into external tools.” The proxy logs and DLP incidents tell a different story.

The scale of adoption confirms the mismatch. McKinsey’s State of AI in 2025 survey found that 88 percent of organizations now use AI in at least one business function, up from 78 percent a year earlier — yet only about 7 percent report AI fully scaled across the enterprise, and only a small fraction qualify as high performers who have genuinely rewired both workflow and governance. Nearly everyone is using it. Almost no one has it under control.

Sanctioned versus shadow: draw the line at the vendor tier

Many organizations muddle the discussion by treating all AI usage as one amorphous category. That is a mistake. Sanctioned AI sits behind single sign-on, logging, DLP, and identity management, with validated data paths and contractual retention terms. Shadow AI lives in private browser tabs and personal accounts, with a shrug of “we think they don’t train on our data, but we’re not sure.”

The single most important governance lever is which tier of a vendor’s product employees actually use, because the data terms differ sharply between consumer and enterprise editions. OpenAI does not train on ChatGPT Enterprise, Team, or API business data by default. Anthropic’s enterprise and API products — Claude for Work, Bedrock, Vertex — are excluded from training, while its consumer tiers were changed in 2025 to use chats for training unless the user opts out, with retention extended for those who do not. Google’s Vertex AI is contractually excluded from training, while consumer Gemini activity is retained and may be human-reviewed. The operational takeaway is blunt: a reimbursed personal “Pro” subscription used for company work is a data-exposure vector, not a sanctioned tool.

If your AI strategy deck does not explicitly name Shadow AI as a separate category with its own risk behavior, you are under-modeling reality. Part Two shows what that reality looks like when it goes wrong.

Incident War-Stories

The stories below blend documented incidents — attributed, with CVE identifiers, researchers, and dates — with one clearly labeled illustrative composite that stitches real mechanics into a realistic scenario without naming any victim. The discipline matters: some of what follows is verified fact, some is vendor-reported and disputed, and one is deliberately synthetic. Each is marked accordingly.

1 — EchoLeak: the zero-click that proved the point

DOCUMENTED. In June 2025, researchers at Aim Labs disclosed EchoLeak (CVE-2025-32711), a critical flaw rated 9.3 in Microsoft 365 Copilot. It is the first widely reported zero-click prompt-injection attack to achieve concrete data theft in a production AI system. An attacker sends an ordinary-looking email carrying a hidden instruction — white text on a white background, or buried in an HTML comment. When the victim later asks Copilot a routine question, Copilot’s retrieval pipeline pulls the poisoned email into context and executes the attacker’s instructions, quietly embedding the user’s most sensitive data into an outbound image URL that fires the moment the response renders. Aim Labs named the underlying weakness an “LLM scope violation,” and the exploit chained four separate bypasses, ending with exfiltration routed through a Microsoft-owned proxy that the content-security policy already trusted. Microsoft patched it server-side; there is no evidence of exploitation in the wild. Its significance is conceptual: it turned “prompt injection is theoretically dangerous” into “prompt injection exfiltrates SharePoint, OneDrive, Teams, and Outlook data with zero clicks.”

2 — AgentFlayer and ShadowLeak: connectors as exfiltration channels

DOCUMENTED. At Black Hat in August 2025, Zenity researchers demonstrated AgentFlayer: a poisoned Google Drive document carrying a three-hundred-word prompt in one-pixel white font that instructed ChatGPT to hunt the victim’s connected Drive for API keys and exfiltrate them through an image URL — triggered by nothing more than “summarize this document.” They showed the technique generalizing across ChatGPT, Microsoft Copilot Studio, Cursor, Salesforce Einstein, and Google Gemini. Weeks later, Radware disclosed ShadowLeak, a zero-click injection in ChatGPT’s Deep Research agent connected to Gmail. Because the exfiltration happened from OpenAI’s own cloud rather than the user’s device, it left no artifact on the endpoint or the corporate network — defeating traditional defenses entirely until OpenAI patched. The lesson: every connector that feeds untrusted text to an agent — email, Drive, SharePoint, GitHub, Notion — is a potential exfiltration path.

3 — The Rules File Backdoor: poisoning the coding assistant

DOCUMENTED. In March 2025, Pillar Security disclosed the “Rules File Backdoor,” a supply-chain attack against the AI code editors GitHub Copilot and Cursor. Attackers hide invisible Unicode characters inside the configuration “rules files” that steer these assistants. The concealed instructions — unreadable to a human reviewer but perfectly legible to the model — direct the assistant to inject backdoors, hardcoded credentials, or exfiltration code into its output, and to say nothing about having done so. Poisoned rule files ride through project templates, shared configs, and pull requests, and survive forking. With enterprise developer adoption of AI coding tools now near-universal, this weaponizes the developer’s most trusted assistant through the channels they trust most.

4 — The MCP CVE wave: agent plumbing under attack

DOCUMENTED. As the Model Context Protocol became the default connective tissue for coding agents, its security debt came due. Check Point disclosed MCPoison (CVE-2025-54136) in Cursor, where an attacker commits a harmless MCP configuration to a shared repository, waits for approval, then swaps in a malicious payload that executes on every subsequent session with no re-approval — persistent remote code execution reaching any credential the editor can touch. Its sibling CurXecute (CVE-2025-54135) abused message parsing. A vulnerability in the widely downloaded mcp-remote package (CVE-2025-6514) and an authentication bypass in MCP Inspector (CVE-2025-49596) followed, alongside a backdoored Postmark MCP server caught silently blind-copying outbound email to its maintainer. Researchers have since cataloged dozens of MCP-related CVEs. The through-line: in an agent, a tool description is executable context, and “syntactically valid” is not the same as “safe.”

5 — Slopsquatting: hallucinated dependencies as a real supply chain

DOCUMENTED RESEARCH. A study presented at USENIX Security 2025 generated 576,000 code samples across sixteen language models and found that nearly one in five recommended software packages did not exist — about 5 percent for commercial models and over 21 percent for open-source ones — producing more than 200,000 unique fictitious package names. Critically, many hallucinated names recurred predictably across repeated runs of the same prompt, which is exactly what an attacker needs: pre-register the invented package under a malicious payload and wait for an AI assistant to recommend it. The practice earned the name “slopsquatting.” An AI coding assistant can invent a dependency, and an adversary can make that invention real and hostile.

6 — The first reported AI-orchestrated espionage campaign

REPORTED, DISPUTED. In November 2025, Anthropic reported that it had disrupted what it described as the first documented AI-orchestrated cyber-espionage campaign, attributing it with high confidence to a Chinese state-sponsored group it designated GTG-1002. By Anthropic’s account, the operation used its Claude Code tool to execute the large majority of tactical work autonomously across roughly thirty targets — technology firms, financial institutions, chemical manufacturers, and government agencies — with a handful of successful intrusions. The operators reportedly bypassed guardrails by role-playing as employees of a legitimate security-testing firm and by decomposing the attack into innocuous-looking sub-tasks. Anthropic also noted that the model frequently overstated its findings and sometimes fabricated data, which limited full autonomy.

Handle with care. These are Anthropic’s own claims, and credible researchers pushed back hard — pointing to the complete absence of published indicators of compromise, questioning whether attackers could coax capabilities from the model that defenders cannot, and characterizing the disclosure as self-serving. Treat this as reported, not independently verified. It belongs in the briefing because the direction is real: agentic tooling lowers the labor cost of intrusions whether or not this specific account holds up in every detail.

7 — The reimbursed-subscription leak

ILLUSTRATIVE COMPOSITE. A composite built entirely from documented mechanics, with no real victim. A mid-market firm reimburses employees for personal ChatGPT and Claude subscriptions. A finance analyst pastes a board deck and a customer list into a consumer chat to “make a quick summary.” Because those consumer tiers default to retention and training unless someone thought to opt out, the material now sits on vendor infrastructure with no data-processing agreement, no residency control, and no enforceable deletion right — precisely the exposure IBM ties to Shadow AI’s six-figure cost premium. No alert fires. The traffic looks like ordinary SaaS usage. This unglamorous, everyday incident is where most real Shadow AI risk actually lives, and no war story about zero-click exploits should let it fade from view.

Blueprint for an AI-Aware SOC

The Security Operations Center that can actually defend against Shadow AI looks different from a 2022 SOC. It ingests new telemetry, hunts for new behaviors, and runs new playbooks. The good news is that the tooling to do this now exists. What follows is a build order.

1. Anchor to frameworks so detections have a taxonomy

Give the work a shared vocabulary before writing a single detection. Three bodies of knowledge do most of the load-bearing. OWASP publishes a Top 10 for LLM Applications — with prompt injection ranked first for the second edition running, alongside sensitive-information disclosure, supply-chain risk, data and model poisoning, and excessive agency — and, as of late 2025, a dedicated Top 10 for Agentic Applications covering goal hijacking, tool misuse, and identity confusion. MITRE ATLAS catalogs adversarial tactics and techniques specific to AI systems, and its recent releases added generative-AI techniques such as RAG poisoning, prompt crafting, and AI supply-chain compromise; usefully, the majority of its mitigations map to controls you already run. NIST’s AI Risk Management Framework and its Generative AI Profile supply the governance scaffolding — Govern, Map, Measure, Manage — with Google’s SAIF, ISO 42001, and the Databricks security framework adding architectural depth.

The operating model in one line: NIST tells you what to govern, OWASP tells you what to monitor, and MITRE ATLAS tells you what attacks to detect and hunt.

2. Discovery: find the Shadow AI first

You cannot defend what you cannot see, and no single tool sees everything, so layer the sources:

• CASB to identify AI SaaS usage and the OAuth grants employees have handed to third-party AI apps.

• Prompt- and upload-aware DLP at the browser layer, to catch PII, source code, and secrets headed for AI endpoints — the Samsung failure mode.

• Network and egress analysis for traffic to known AI API domains and local model interfaces.

• AI Security Posture Management (AI-SPM), an emerging purpose-built category that inventories both managed and shadow AI, flags misconfigurations, and enforces policy inline where legacy DLP and CASB tools cannot.

• An AI Bill of Materials (AI-BOM) to inventory the models, datasets, and dependencies you actually run, using the ML-BOM extensions now supported in CycloneDX and SPDX.

3. Telemetry: instrument the agents

Treat every AI agent as a non-human identity that must be logged like any privileged account. Stream agent activity into the SIEM — Microsoft’s Agent 365 connector, for instance, now feeds agent telemetry into the Sentinel data lake so agent actions can be correlated with identity, endpoint, and cloud signals. For classic agents running on service principals, watch the service-principal sign-in logs closely: a service principal authenticating from a first-seen IP address is a high-fidelity credential-theft signal. At runtime, kernel-level sensors that observe process spawning, file reads, and API calls let you tie a suspicious tool call back to what the agent actually did on the host.

4. Detection engineering for AI risk

Translate the frameworks into detections that fire on the behaviors the war stories exposed:

• Exfiltration to AI endpoints — sensitive-data uploads to AI domains, and the anomalous outbound image and URL renders that carried the payload in EchoLeak and AgentFlayer.

• Prompt-injection indicators — hidden Unicode, white-on-white text, HTML comments, and reference-style Markdown inside any content an agent ingests.

• AI API usage anomalies — consumption spikes consistent with denial-of-wallet or unbounded resource abuse.

• Non-human identity abuse — behavioral baselines for each agent and service-principal identity, flagging deviations in role-assumption calls, new lateral connections, and token reuse.

Publicly available building blocks — Sigma rules tagged by CVE, Sentinel KQL detections, and vendor guidance on defending against indirect prompt injection — give you a running start rather than a blank page.

5. Threat hunting

Hunt for agent actions that lack clear human context, for goal drift where an agent’s behavior wanders from its stated task, and for tool misuse that still looks superficially legitimate — the exact pattern the agentic Top 10 foregrounds. When you find a lead, use graph-based investigation to pivot across identities, endpoints, and cloud resources and establish the true blast radius before you contain.

6. AI red-teaming as a continuous discipline

Adversarial testing of your AI systems is moving from best practice to compliance requirement. Build it into the pipeline with open tooling: PyRIT for programmatic, multi-turn attack orchestration; Garak for broad, one-command model vulnerability scans; and Promptfoo for regression testing that gates model and prompt changes in CI. A mature program runs breadth scans nightly, deeper multi-turn campaigns each sprint, and treats a failed red-team probe like a failing unit test.

7. AI incident-response playbooks

Extend incident response to treat AI as an attack vector in its own right. Revoke and rotate connector tokens, OAuth grants, and API keys; isolate or disable the affected agent; and preserve the prompt and response logs as primary evidence. Build in the hard lesson from ShadowLeak: when exfiltration happens on the vendor’s infrastructure, there may be nothing to find on your endpoints or network, which means your data-processing agreements and the vendor’s own logs become part of your evidence chain. Rehearse all of this in tabletop exercises that explicitly include prompt injection and agent-hijack scenarios.

8. Culture: build “Sunlight AI,” not the “Framework of No”

The deny-by-default posture is precisely what creates Shadow AI. When security cannot say a credible “yes,” employees stop asking. The durable move is to bring AI usage into the light where it can be governed: provision secure, sanctioned alternatives with real data-processing terms; require training as a condition of access; stand up an AI governance committee that includes security from day one; and frame disciplined AI use as a competitive advantage rather than a compliance headache. Shadow AI thrives where AI is either hyped uncritically or suppressed reflexively. It shrinks where AI is understood, respected, and governed.

◆ ◆ ◆

A staged roadmap

None of this happens at once. Sequence it by cost and by risk.

Stage 1 — Get visibility (0–30 days). Run Shadow AI discovery across CASB, browser DLP, and egress analysis. Inventory reimbursed personal AI subscriptions and cut off consumer-tier tools for company data. You are done when you can enumerate every AI tool and connector in use. Escalate the moment discovery reveals sensitive data flowing to consumer tiers.

Stage 2 — Contain the costliest paths (30–90 days). Provision sanctioned enterprise AI with proper agreements and no-training guarantees, enforce DLP on AI uploads, verify Copilot, Cursor, and any MCP servers against the documented CVEs, and constrain agent OAuth scopes and service-principal permissions. The benchmark is simple: no regulated data reaches an unsanctioned endpoint.

Stage 3 — Operationalize detection (90–180 days). Stand up agent telemetry in the SIEM, deploy AI-specific detections mapped to OWASP and MITRE ATLAS, and baseline your non-human identities. Prove it with a measurable mean-time-to-detect for a simulated prompt-injection exfiltration.

Stage 4 — Institutionalize (180+ days). Make red-teaming continuous, run AI incident-response tabletops, keep the governance committee and the AI-BOM alive, and map your regulatory obligations to the systems you actually own.

◆ ◆ ◆

Turning Shadow AI from liability into signal

There is an uncomfortable truth at the center of this: Shadow AI exists because your people are ahead of your strategy. Through a security lens that is a risk. Through a leadership lens it is also intelligence — a live map of where teams are desperate for automation, which workflows are ripe for safe augmentation, and which tools are already proving their value at the edge of the organization.

You cannot stop your people from using AI, and you should not try. But you can decide whether that usage stays invisible and dangerous, or becomes visible, governed, and strategic. The organizations that win the AI era will not be the ones that avoided Shadow AI. They will be the ones that discovered it honestly, classified it rigorously, replaced the bad patterns with secure paths, and kept learning from it.

Three questions to carry into your next leadership meeting. Do we have hard data on which AI tools are in use across our environment? Have we defined — down to example prompts — which data types are off-limits to external AI? And what sanctioned, secure AI channels have we given people so they don’t have to improvise? If the honest answers are “no,” “sort of,” and “we’re working on it,” then you do not have a Shadow AI problem someday. You have one now.

◆ ◆ ◆

A NOTE ON SOURCING

This briefing distinguishes observed evidence from inference. The breach economics are drawn from IBM’s 2025 Cost of a Data Breach Report and McKinsey’s State of AI in 2025; the code-security and slopsquatting findings from Veracode’s 2025 GenAI code research and a USENIX Security 2025 study. EchoLeak, AgentFlayer, ShadowLeak, the Rules File Backdoor, and the Model Context Protocol CVEs are documented incidents with named researchers, identifiers, and disclosure dates. The GTG-1002 espionage account is reported by a single vendor and disputed by credible researchers; it is presented as such. The seventh war story is an explicit composite. A handful of the most recent items carry 2026 timestamps and should be re-verified against primary sources before republication.