Shadow AI

Shadow AI is the use of artificial intelligence tools, models, and services inside an organization without the knowledge or approval of its IT, security, or compliance teams. Typical cases include employees pasting work into a personal account on a generative AI assistant, developers calling an unreviewed model API, and teams switching on AI features in software they already use. Shadow AI is a subset of shadow IT, the older problem of unapproved apps and cloud services, and it grows for the same reason: the tools are free or cheap, take minutes to adopt, and make people faster.

Why Shadow AI Differs From Shadow IT#

AI services process the data they receive as well as store it. Every prompt sent to a large language model (LLM) leaves the organization, and consumer plans may retain conversations or use them as training data unless the user opts out. In 2023, Samsung engineers pasted confidential source code and meeting notes into ChatGPT, and the company then restricted generative AI tools on its devices.

The risks also run in the other direction. Output from an unreviewed assistant can carry hallucinations, insecure code, or text under unclear license into products and decisions without anyone checking it. Model weights downloaded from public hubs such as Hugging Face can run arbitrary code when loaded if they use Python's pickle format, which is why the safetensors format stores only tensors. AI agents connected to email, calendars, or code repositories with an employee's personal token can act on company systems, and a malicious web page or document can steer them through prompt injection.

The cost shows up in breach data. IBM's 2026 Cost of a Data Breach report found that 43% of the breached organizations it studied had incidents involving shadow AI, up from 20% a year earlier, and that those breaches cost an average of $5.39 million against an overall average of $4.99 million.

Common Forms of Shadow AI#

• Chatbots and writing assistants: Personal accounts used to summarize contracts, debug proprietary code, or draft replies containing customer records.
• Embedded AI features: A vendor adds transcription, summarization, or meeting notes to an approved tool, and the feature starts sending data to a new subprocessor without a fresh review.
• Unvetted models and APIs: Developers send images to an external vision API or deploy downloaded weights whose license, provenance, and security nobody has checked.
• Browser extensions and agents: Tools that read every page an employee opens or act on their behalf across connected accounts.

Detecting and Reducing Shadow AI#

Discovery combines several signals: network and DNS logs showing traffic to AI endpoints, cloud access security brokers and data loss prevention tools that inspect uploads, browser extension inventories, expense reports for AI subscriptions and API keys, and surveys or amnesty programs in which teams declare the tools they use. Each discovered tool then goes through the same triage, shown below, and lands in the inventory that AI governance depends on.

Programs that reduce shadow AI pair clear rules on what data may go into which tools with sanctioned options that are as easy to use: enterprise accounts with training on customer data disabled, an AI gateway that logs and filters all model traffic, and self-hosted models for the most sensitive work. AI literacy training explains why the rules exist and which tools are approved.

Computer vision work has its own version of the problem when images of people, products, or facilities sit in personal accounts on online labeling and training tools. In an Ultralytics Platform team workspace, datasets, models, and deployments that any member creates belong to the team, every member can see them, and Owner, Admin, Editor, and Viewer roles decide who can change them.

Shadow AI is a visibility problem that turns into data privacy and data security incidents, since a security team cannot assess, protect, or monitor a tool it does not know exists. The NIST AI Risk Management Framework addresses it in subcategory GOVERN 1.6, which calls for mechanisms to inventory AI systems, resourced according to organizational risk priorities.