Shadow AI is the use of AI tools, models or agents the organization has not approved or recorded. The main risks are data leaving through prompts, agents with unknown access, unvetted models, compliance gaps and unchecked output. Bring it into the open with discovery, clear limits and a good approved option.
Why does it happen?
Because the tools help and the approved path is slow. Staff paste a contract into a chatbot to summarize it, install a coding assistant, or connect an agent to their mailbox. They are trying to do the job faster, not to cause harm. A ban without an alternative pushes the use further out of sight.
Risk one: data leaves through prompts
OWASP's entry on sensitive information disclosure notes that LLM applications can expose personal data, financial details, health records, confidential business data, credentials and legal documents, and that users need to understand the risk of unintentionally providing sensitive data that may later appear in output. It recommends data sanitization so user data does not enter training, and clear terms of use with an opt-out. With shadow AI you have no control over any of those terms, because you do not know which service received the data.
Risk two: agents with unknown reach
OWASP's Excessive Agency entry describes damaging actions taken in response to unexpected, ambiguous or manipulated model output, and lists three root causes: excessive functionality, excessive permissions and excessive autonomy. A personal agent connected to company email, files and a code repository has all three by default. Nobody reviewed the tool list, scoped the access or decided which actions need a person.
Risk three: unvetted models and packages
OWASP's supply chain entry says LLM supply chains are susceptible to vulnerabilities affecting the integrity of training data, models and deployment platforms, and extend traditional package risks to third-party pre-trained models and data. A developer who downloads a model or a plugin from a public hub has made a supply chain decision without a review.
Risk four: legal and regulatory exposure
The NIST AI Risk Management Framework places legal and regulatory requirements involving AI under its Govern function, along with policies, processes and ongoing monitoring. If you cannot list your AI use, you cannot show you met any of these. Customer contracts, privacy law and sector rules may restrict where certain data goes, and shadow use ignores those limits by default.
Risk five: output taken as fact
OWASP also covers misinformation, where models produce plausible but false content. An unreviewed AI summary in a customer reply or a security finding that nobody checked becomes the company's statement. Shadow use has no review step at all.
What does a typical case look like?
Constructed example: a finance analyst connects a free AI assistant to the shared drive to reconcile invoices faster. The assistant works. It also now has read access to the entire drive, including the folder with salary data, under terms of service nobody read. Two months later the analyst leaves, and the connection and its token remain.
How to check or apply this
- Find it first: review network and identity logs for AI services, ask teams in a short survey, and check which OAuth app grants and browser extensions are in use.
- Publish a one-page policy: approved tools, data that must never be pasted, and actions an agent may not take alone.
- Offer an approved option that is good enough that people will use it.
- Enforce limits where you can: allow lists, data rules, scoped credentials for agents, and logs of tool calls.
- Review app grants and agent tokens regularly, and remove them when people change roles.
- Train with real examples, not rules alone, and make asking for a new tool easy.
- Review the policy on a calendar, since the tool list changes monthly.
Safeguard's MCP Guardrail and agent identity put limits and identities on agent tool calls, and asset discovery helps you see what is running. They sit alongside a clear policy, not in place of one.
Quick check
Should we just ban AI tools?
A ban without an approved alternative tends to push use out of sight. Offer a sanctioned tool, set data limits and monitor.
What is the biggest shadow AI risk?
It depends on the data and the access involved. Sensitive data in prompts and agents with broad permissions are usually the first two to check.
Sources
- OWASP Gen AI Security Project, LLM02:2025 Sensitive Information Disclosure
- OWASP Gen AI Security Project, LLM06:2025 Excessive Agency
- OWASP Gen AI Security Project, LLM03:2025 Supply Chain
- OWASP Gen AI Security Project, LLM09:2025 Misinformation
- NIST AI Risk Management Framework, NIST AI 100-1
Last reviewed: 18 October 2026.
