[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [No Hackers Required: 10 Shadow AI Leaks Hiding in Plain Sight](/blog/10-shadow-ai-leaks-in-plain-sight) Publish date October 29, 2026 {x} minute read # No Hackers Required: 10 Shadow AI Leaks Hiding in Plain Sight [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/the-state-of-shadow-ai) [Free trial](/demo) Written by [Revashni Moodley](/team/revashni-moodley) Content Writer Revi is a cyber writer with a background in business analysis and data management. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Report The State of Shadow AI - Trends, Insights & Statistics Free resource ### The State of Shadow AI - Trends, Insights & Statistics [Download now](/resources/the-state-of-shadow-ai) "The call is coming from inside the house." It's one of horror's oldest lines, and you already know how the scene goes. The team scrambles, rechecks every firewall, audits every login, hunting for an intruder. Then the trace comes back, and there isn't one because there is no malware or forced entry. Just an employee, at their own desk, with their own login, who pasted a confidential spreadsheet into an unapproved AI tool to save 10 minutes before a deadline. It's tempting to file that under mistake rather than breach, but the numbers say otherwise. [IBM's 2026 Cost of a Data Breach Report](https://www.ibm.com/reports/data-breach?utm_campaign=21173269-2508-ap-aw-misc-upguardian-newsletter\&utm_medium=email&_hsenc=p2ANqtz--DR04Wsh5l9V8mMUudJv_dgtGN10V4jnUE_z03FialnqvhgNJ22d6iaFnpQXmEUm4rxwTH1PGdxMiWNJp3lEkGh7xXyNK0_2kyYfWZU2Dc5JlfRyQ&_hsmi=2\&utm_content=2\&utm_source=hs_email) found that security incidents involving shadow AI (unapproved AI tools employees use without IT's knowledge) jumped to 43% this year, more than double last year's share. Those incidents cost organizations an average of $5.39 million, and nearly half (49%) resulted in data loss or compromise. That's the part worth sitting with. Nothing about these incidents looks like an attack while it's happening because nothing was attacked. It's an employee under a deadline, not an adversary. They don't think of what they're doing as a breach; they think of it as getting through their to-do list faster. It's the pattern behind every entry on this list: 10 Shadow AI leaks where the security team went looking for a hacker, and found a coworker instead. ## 1. The engineers who pasted Samsung's secrets into ChatGPT **Date:** March - April 2023  **Category:** Source code exposure Three Samsung semiconductor engineers had the same idea within 20 days of each other: paste code into ChatGPT to debug it faster, or to summarize a meeting recording instead of writing notes by hand. There was no intrusion to investigate and no malware to trace. However, proprietary source code, yield optimization data, and an internal recording simply became part of a public model's training data the moment they hit send. **The fix: **an enterprise AI gateway with prompt inspection that flags source code before it reaches an external model. At the time, Samsung [banned generative AI company-wide](https://www.legaldive.com/news/Samsung-ChatGPT-leak-data-privacy-generative-AI/647397/) within weeks. This was one of the first incidents to demonstrate that a company's crown-jewel intellectual property could leave the building through a completely unremarkable channel, a browser tab, for instance. It's become the reference case cited in nearly every corporate generative AI policy written since. ## 2. The banker who wanted cleaner slides at CB Financial Services  **Date:** May 2026 **Category:** Regulatory disclosure An employee at CB Financial Services needed a customer presentation finished quickly and turned to an AI tool nobody in IT approved. No system was breached, and no credentials were stolen, but customer names, Social Security numbers, and dates of birth still went into the tool willingly. **The fix:** a cloud access security broker policy blocking unsanctioned SaaS destinations, paired with Shadow AI discovery tools monitoring for unapproved web traffic, is the kind of control built to catch exactly this pattern. CB Financial's case went on to settle a question boards had been quietly avoiding. Does an employee's AI shortcut count as a real breach? Its Securities and Exchange Commission [Item 1.05 disclosure](https://www.wsgr.com/en/insights/shadow-ai-triggers-first-sec-form-8-k-for-unauthorized-ai-use-what-financial-institutions-and-public-companies-need-to-know.html), the first ever triggered by unauthorized AI use rather than an external cyberattack, gave regulators an answer: yes. It now sits alongside ransomware and stolen credentials as a disclosable cybersecurity event. ‍ ## 3. The developer who clicked "Accept All Permissions" at Vercel **Date:** April 2026  **Category:** Open authorization (OAuth) compromise A malware infection at Context.ai, an AI plugin used to speed up workflows, started the chain. But what turned a vendor problem into a company-wide incident was an OAuth token a Vercel employee had approved with sweeping, unreviewed permissions. Attackers used that access to exfiltrate customer environment variables and demand [two million dollars in extortion](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-saas-supply-chain-vercel-contextai-2026/). **The fix:** automated OAuth consent monitoring, flagging, and revoking overprivileged tokens before they sit dormant for months. An employee pasting proprietary material into a chatbot is only one entry point now. The sprawl of AI plugins and integrations quietly granted standing access to production systems is another, and it's now treated as a governance category worth auditing with the same rigor as employee access itself. ‍ ## 4. The contractors who saw everyone else's conversations at Meta  **Date:** 2024-2025 **Category: **Vendor pipeline failure Contractors hired to fine-tune Meta's generative AI models for safety and accuracy found something they weren't supposed to see. That is unredacted personal information, including full names, phone numbers, and home addresses, in[ up to 70% of chat logs](https://www.entrepreneur.com/business-news/meta-ai-contractors-reportedly-saw-user-personal-data/495548) one contractor reviewed. And nobody broke in to get that data. **The fix:** automated classification and masking of personally identifiable information (PII), applied at the point of ingestion so no human reviewer ever sees a raw conversation. Instead, internal pipelines routed user conversations straight to contractor dashboards with no scrubbing step in between. This one is structural; it was an AI development pipeline exposing its users by design, illustrating why Shadow AI governance has to extend backward into how a company builds its own AI products, not just how employees use someone else's. That is the same job [AI governance platforms](/blog/best-ai-governance-platforms) are sold to do — visibility plus control, not just an acceptable-use PDF. ‍ ## 5. The cybersecurity chief who used the wrong tool at CISA **Date:** January 2026 **Category: **Government data exposure The interim director of the Cybersecurity and Infrastructure Security Agency (CISA) needed federal contracting documents reviewed quickly and uploaded at least four files marked "For Official Use Only" (FOUO) to public ChatGPT [under a personal exception](https://www.politico.com/news/2026/01/27/cisa-madhu-gottumukkala-chatgpt-00749361). The upload triggered the agency's own security sensors and the U.S. Department of Homeland Security review.  **The fix:** endpoint data loss prevention blocking uploads of classified or FOUO-marked files to unsanctioned AI domains, with no personal-use carve-out for anyone, is the exact control required for this scenario. This incident made headlines because the person who triggered it was also the person whose job was to prevent it. A reminder that Shadow AI discipline has to reach the top of the organizational chart, exemptions and all. ‍ ## 6. The contractor racing to help flood victims through Australia's Resilient Homes Program **Date:** October 2025 **Category: **Government contractor exposure A contractor working to process disaster relief applications for three thousand flood survivors under Australia's Resilient Homes Program needed to sort the data faster. They [uploaded an entire unredacted spreadsheet to ChatGPT](https://www.nsw.gov.au/departments-and-agencies/nsw-reconstruction-authority/northern-region/northern-rivers/resilient-homes-program-data-breach), over twelve thousand rows of names, addresses, dates of birth, and sensitive medical details, all at once. **The fix:** endpoint controls blocking browser upload dialogs from sending structured spreadsheet data to unapproved AI tools are built to catch exactly this kind of upload. This incident matters because it hit flood survivors who were already dealing with the aftermath of a disaster, whose private health information became collateral damage of someone else's productivity shortcut. It's a reminder that Shadow AI risk follows government contractors and vendors just as easily as employees, and that this program didn't have the safeguards to catch it. ‍ ## 7. The AI research team that shared a little too much information at Microsoft **Date:** June 2023 **Category: **Cloud misconfiguration Microsoft's own AI research division wanted to publish an open-source image recognition model for the research community. To share the files, [a researcher generated an Azure access token ](https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers)scoped to "full control" of the entire storage account instead of a single folder. The token sat exposed on GitHub for three years, quietly granting access to 38 terabytes of unrelated data such as employee workstation backups, over 30,000 internal Teams messages, and private keys. **The fix:** automated cloud security posture management, flagging overprivileged storage tokens before a public repository goes live. This incident is a useful counterexample to the rest of this list because while nobody pasted anything into a chatbot, the exposure resulted from the infrastructure behind the AI research itself. It's a clear illustration that AI initiatives inherit every existing cloud misconfiguration risk, and then some, since sharing open models often requires exactly the kind of broad access token that's easiest to overscope. ‍ ## 8. The venture capital partners who forgot the bot was still listening **Date:** September 2024 **Category: **Meeting assistant overreach A founder's pitch call ended with a venture capital firm, or so he thought. Otter.ai's notetaker, [still connected after he left](https://www.uctoday.com/security-compliance-risk/otter-ai-lawsuit-meeting-bot-recording-after-call/), captured the investors' private post-meeting discussion about him and emailed the full transcript to every invitee, founder included. The investors apologized, and the deal was canceled. [Otter.ai now faces a 2025 lawsuit](https://incidentdatabase.ai/cite/811/) alleging its tools recorded meetings without every participant's consent, in violation of California wiretap law.  **The fix:** a meeting-bot governance policy, requiring explicit host approval for AI notetakers and an automatic disconnect the moment a host ends the call, is the safeguard this scenario points to. This entry opens up a category of risk unique on this list, since no employee pasted anything anywhere; an AI tool kept doing its job long after the humans in the room assumed it had stopped. Any company running meetings through an AI notetaker carries the same exposure. ‍ ## 9. The engineers who made their own legal team nervous at Amazon  **Date:** 2023 **Category: **Source code exposure Amazon developers debugging backend code found ChatGPT a faster way to work through problems. Amazon's own legal team noticed the tool producing outputs that closely resembled internal, unpublished code and warned staff company-wide not to paste proprietary material into the tool. **The fix:** an internal AI proxy, routing developer prompts through a layer that strips proprietary code signatures before they reach a third-party model, is the kind of control that removes the need for a warning after the fact. What makes this one notable is timing.[ An Amazon lawyer told employees ](https://gizmodo.com/amazon-chatgpt-ai-software-job-coding-1850034383)in an internal Slack channel that ChatGPT's output had "already" started to closely resemble existing internal material, catching the exposure through pattern recognition rather than an external researcher or regulator. It's an early example of legal and compliance teams acting as a frontline defense against Shadow AI simply by noticing when an AI's answer knows a little too much. ## 10. The click that turned private ChatGPT chats into Google results  **Date:** August 2025 **Category:** Search-engine exposure\ \ OpenAI let users click "Share" on a ChatGPT conversation and, if they left one box checked, make it "discoverable." Most people had no idea what that meant. By the time [Search Engine Land reported it](https://searchengineland.com/google-indexing-shared-chatgpt-conversations-459839), a search for shared conversations was turning up sensitive business details, personal names, roles, and strategies, including one indexed chat that publicly listed a senior consultant's full name, age, and job description alongside her client work. This leak included proprietary strategies and client work, alongside people's PII. **The fix:** a policy limiting AI conversations to an approved, access-controlled tool, paired with basic training on what "share" actually does in consumer AI products. Unlike every other entry on this list, this wasn't one company's mistake. It was thousands of individual share links, each assumed private, becoming searchable at once. This incident shows that even sharing a link, the single most ordinary action on the internet, can be the door left unlocked. ‍ Report The State of Shadow AI - Trends, Insights & Statistics Free resource ### The State of Shadow AI - Trends, Insights & Statistics [Download now](/resources/the-state-of-shadow-ai) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) October 29, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)