TL;DR: Every AI tool your team uses without asking is a vote on the official path: too slow, too rigid, or missing. Read the votes before you ban the tools: giving people a sanctioned tool cut personal-account use where blocking did not, and nobody measures how long it takes to say yes. Data leaves through free accounts, tools expensed on a card, and local agents. A local agent installs in ten minutes with full access to the laptop. Praise AI in speeches and punish its early adopters, and people learn to hide. Run an amnesty inventory, leadership first, and publish time-to-yes by requester level. Fix the cause with training and a sanctioned alternative, offered fast.
Want to listen to this article?
Subscribers to the Orion Playbook newsletter can listen to the AI-Generated Audio version of this article for free. Already a subscriber? Log in here
Early in the generative AI wave, AI note-takers started joining our video calls before IT knew they existed. This was at a fast-moving software company where I ran the largest business unit. Someone signed up with a corporate credit card, a bot transcribed the meeting, and everyone who got the summary wanted one.
It ended the way these things end: someone invited the "wrong" colleague, the one responsible for cybersecurity. An all-staff email followed. Every word of those meetings sat on servers we knew nothing about, under terms nobody had read, with no promise it would stay out of someone else's training data.
Employees have routed work around IT for decades, through shadow SaaS and unapproved software. What AI changed is how fast the material leaves, and where it can end up: inside a model someone else owns or, worse, in an attacker's hands through prompt injection.
It now leaves three ways, each more committed than the last. The free account: one click, one "I agree," terms unread. The paid tier on a card and then the expense report, so the company funds a tool its own policy forbids. And the local agent. Then there is the route that needs no new tool: the assistant built into the browser and suite the company already approved. Whether that assistant may read the confidential intranet page in the next tab is a default nobody inside the company chose.
I experiment with local models and AI agents on my own machine. My first install took a day; today a desktop app downloads the models and sets everything up in ten minutes, no questions asked. The agent then has full access to the laptop: files, terminal, apps, browser, and every stored credential. Chat-era controls watch what a person types. An agent acts on the intent of whoever configured it.
Each of these tools tells you something: the official path is too slow, too rigid, or missing. They also prove people want to work differently with AI, badly enough to cut corners. Shadow AI is a vote before it is a breach, and votes are meant to be heard. The loudest voters sit near the top: senior leaders report the most willingness to trade security for speed, and a ban signed by its heaviest violators teaches everyone else that the policy is optional. It also contradicts itself: leaders tell everyone to use more AI while policy punishes the people who started first. When words and acts disagree, people believe the acts. Lead with the stick alone and the organization learns one lesson: hide better.
Most of these votes are cast without asking: someone priced the queue and skipped it. A request from the C-suite moves fast; the same request from the front line, where the need is most specific, can go unanswered. What moved behavior was a sanctioned tool. In one year, personal AI accounts at work fell sharply as company-managed accounts rose. Blocking was already common. Over the same period, the share of breaches involving shadow AI more than doubled while strict approval processes thinned. Nobody I could find counts how long it takes to say yes to a new AI tool. Call it time-to-yes.
Lockdown and a free-for-all both fail, and both warn you early. Lockdown's signs are a lengthening approval queue, "we don't use AI here" said with a straight face, and capable people who stop asking. A free-for-all is an agent list nobody can produce and company material turning up where it shouldn't. Blocking a specific high-risk app is cheap and sensible.
Start with an amnesty inventory of what people actually use, penalty-free, sorted into three piles: no approved alternative, a worse approved alternative, and habit. It will turn up data already exposed. Amnesty protects the person; the exposure still gets handled. The lasting fix is training plus a sanctioned alternative, offered fast. The first two are your roadmap. Habit is a teaching problem, and teaching is the only fix that reaches the cause. Whoever clicked "I agree" signed the company's data up to those terms, usually without reading them; people who understand that make better calls than any firewall. (Acknowledging the AI policy counts as training only in the AI policy.) The goal is experimentation by people who know what they agreed to. Then take the last three AI tool requests, note who asked, and publish the time-to-yes. Check the AI defaults in the browser and suite you already run. Anyone can start with their own list today and let their AI run the audit. A CEO should start with the leadership team's.
Shadow AI is some of the cheapest market research a company will ever commission, as long as someone is listening. Keep the votes coming.
All the images were generated with AI (ChatGPT Images, Gemini Nano Banana, Claude Opus) by Gérard Métrailler.
Food for your AI
To run the audit on yourself first, paste this into the AI you use most, with its memory and connectors switched on.
Act as a security auditor for this account. Using only what you can verify from your own settings, memory, chat history, connectors, integrations, skills, and MCP servers, list everything you can reach from inside this tool. For each item, say what it can read, what it can change or send, and on whose behalf: which folders a file-system connector opens, which mailboxes and calendars an email or calendar integration covers, what a skill or MCP server can run. Then list what I used you for at work in the last 30 and 90 days, and what data each use touched. Mark every item verified or cannot verify; never guess.
Sources
BlackFog. "BlackFog Research: Shadow AI Threat Grows Inside Enterprises." January 2026. https://www.blackfog.com/blackfog-research-shadow-ai-threat-grows/. Accessed 2026-10-03.
IBM and Ponemon Institute. Cost of a Data Breach Report 2026. IBM, July 2026. https://www-api.ibm.com/adobe/assets/urn:aaid:aem:21111142-1251-4369-86fb-57b82f5bb108/original/as/Cost%20of%20a%20Data%20Breach%20Report%202026.pdf. Accessed 2026-10-03.
Microsoft. "EdgeEntraCopilotPageContext." Microsoft Edge Browser Policy Documentation, Microsoft Learn. https://learn.microsoft.com/en-ie/deployedge/microsoft-edge-browser-policies/edgeentracopilotpagecontext. Accessed 2026-10-03.
Netskope Threat Labs. Cloud and Threat Report: 2026. Netskope, January 7, 2026. https://netskope.com/resources/cloud-and-threat-reports/cloud-and-threat-report-2026. Accessed 2026-10-03.
