Employees adopt AI faster than security teams can review it. When a marketer pastes a confidential brief into a browser extension, or a developer wires an AI agent into internal repositories, it never appears in a security log. That gap between how fast AI spreads and how little security can see is the high-level definition of shadow AI.
Your data is at risk when employees use AI tools, services, or agents your security and IT teams never approved or vetted, such as consumer chatbots, browser AI extensions, personal Copilot accounts, and unvetted Model Context Protocol (MCP) servers. The intent is almost always productivity, but the risk is data leaving your controls and scope, as you can't protect what you can't see.
This piece gives you a working definition for Shadow AI and how it differs from sanctioned AI and shadow IT. We'll discuss the 2026 forces driving its growth, the concrete risks, how to detect usage that bypasses your identity tooling, and the recommended four-state governance model that cuts exposure without banning the tools your teams rely on.
How shadow AI differs from sanctioned AI
The line between sanctioned and shadow AI isn't the tool itself. It's whether someone reviewed the tool and whether you can monitor it in use. The same chatbot can be sanctioned at one company and shadow at another.
Sanctioned AI clears security and legal review, runs under a data processing agreement that sets retention and data-residency terms, and stays visible to your identity and monitoring stack. Unsanctioned AI tools skip all of that. Because they never touch single sign-on (SSO) or your cloud access security broker (CASB), they stay invisible to the tools you'd normally use to find them.
The table below compares the two across approval, data handling, visibility, and enforcement:
Why shadow AI is growing in 2026
Several forces pushed shadow AI from an edge case to a daily reality. They reinforce each other, which is why usage climbed so quickly. Generative AI went mainstream, so any employee can open a capable model in a browser tab and put it to work in seconds, with no budget request or rollout plan.
Agents can now reach your systems, because MCP gives AI agents a standard way to connect to internal systems and data stores, so an agent can act on your environment rather than just answer questions.
AI now ships inside the tools people already use, with Microsoft Copilot and Google Gemini sitting in browsers and productivity suites, so employees meet AI features without ever choosing to adopt them.
The pressure to move faster also outpaces review. Security teams run structured evaluations that take time, while new tools ship every week. That mismatch is already widespread. The UpGuard State of Shadow AI report found that 81% of employees and 88% of security leaders already use unapproved AI tools at work, which means the behavior reaches the people meant to police it.
Shadow AI vs shadow IT
Shadow AI is a newer branch of a familiar problem. To govern it well, you need to see where it overlaps with shadow IT and where it doesn't.
Shadow IT is any software, SaaS application, cloud service, or piece of infrastructure that teams adopt without IT approval. It's been around since employees first registered for their own file-sharing accounts.
Shadow AI is a subset and an acceleration of that pattern. It's the unauthorized use of AI tools, models, agents, and MCP connections specifically. The two overlap. A personal ChatGPT account is both shadow IT and shadow AI. All shadow AI is a form of shadow IT risk, but not all shadow IT involves AI.
AI tools move data out through prompts, uploads, and agent actions, while static SaaS mostly sits and stores it, which changes how you govern them. For that reason, block lists aren't enough; ideally, you want multi-state application policies plus browser-level controls on what employees can paste and upload.
Common shadow AI examples
Shadow AI rarely looks like a security breach waiting to happen. It looks like ordinary work, with an unapproved tool in the loop. These are the patterns that appear most often:
- Customer data in a free chatbot: An employee pastes customer data into free ChatGPT to draft emails, sending regulated information to a service with unknown retention terms.
- An MCP server wired to source code: A developer connects an MCP server to internal repositories without security review, giving an external tool a path to proprietary code.
- A browser extension reading briefs: Marketing installs a browser AI extension to summarize confidential briefs, so sensitive documents flow to an unvetted vendor.
- Personal Copilot accounts: A finance team signs into personal Copilot accounts because the enterprise rollout is delayed, moving financial data outside sanctioned controls.
- A lookalike agent from a registry: An employee installs a "productivity" AI agent from an unverified MCP registry entry, a lookalike server built to impersonate a trusted one.
- A quiet exfiltration pipeline: A browser extension feeds content to an external large language model, and data leaves your organization's boundary without a single alert.
- An over-permissioned agent: An agentic AI workflow gets far more access than its task needs, so a small prompt can trigger broad actions across your systems.
In 2023, Samsung semiconductor engineers pasted proprietary source code, test sequences, and internal meeting notes into ChatGPT across three separate incidents. The company then banned generative AI tools on company devices. The engineers weren't trying to leak anything; they were trying to work faster.
That well-intentioned pattern, rather than malicious intent, drives most real-world shadow AI exposure. Samsung remains the clearest documented case, and the scenarios above show how the same behavior surfaces across other teams.
The risks of shadow AI
These risks cluster into a few categories that compound each other:
- Data leakage: Prompts and uploads can cause a shadow AI data leak, sending personally identifiable information, source code, and credentials to services you don't control. Once that data trains a model, you can't undo it.
- Compliance violations: Sending regulated data to unvetted tools can breach GDPR, HIPAA, and SOC 2 obligations, and newer regimes like the EU AI Act add AI-specific duties. Regulators care about where data goes, not whether the exposure was accidental.
- No audit trail: Outside sanctioned systems, you have no record of what employees shared, which tool they used, or when. IBM's 2025 Cost of a Data Breach Report tied a high level of shadow AI to $670,000 in added breach cost and found that 97% of affected organizations lacked proper AI access controls.
- Supply chain and MCP risk: An MCP server or agent connection can pull from a compromised or lookalike source, extending your supply chain to code you never reviewed. A single malicious registry entry can reach production data.
- Models training on your data: Many consumer tools reserve the right to train on what you submit unless you opt out, so confidential input can resurface later in another user's output.
- Phishing amplification: Generative tools let attackers produce fluent, targeted lures at scale. Leaked internal context makes those messages far more convincing.
How to detect shadow AI in your organization
Detection comes first, and every control downstream depends on an accurate inventory. No single method catches everything, so layered discovery works best:
- Browser-based discovery: Watch how employees use AI in the browser, where most shadow AI tools live. Usage-based discovery catches tools employees sign into with personal accounts, which a purchase-based inventory never sees.
- Network and domain name system signals: Traffic to known AI domains gives you a partial map of activity. Encrypted traffic and personal devices limit how much you can infer this way.
- SSO and CASB gaps: Identity and proxy tools only see services routed through corporate accounts. They miss personal logins and AI browser features that never authenticate against your systems.
- Employee surveys: Asking people what they use gives you an honest baseline and surfaces intent. Self-reported data is incomplete, so treat it as one input, not the full picture.
- MCP server inventory: Scan for agent connections and registry entries across your environment. Look for lookalike servers and connections that reach sensitive systems without review.
For the browser layer specifically, UpGuard User Risk's Shadow AI Monitoring helps you discover unsanctioned AI tools, correlate usage with risk scores, and prioritize findings in the AI Analyst queue.
How to govern shadow AI without killing innovation
Banning AI outright pushes usage further underground. A better model discovers what's in use, sorts it by risk, and guides people toward safe options. Below are the steps required to govern shadow AI without slowing your teams down:
- Discover: Default every newly found AI app to a Tolerated state so it stays visible and under review rather than blocked on sight.
- Classify: Sort every app by the risk it carries and whether it's sanctioned. If you do have a four-state model, the ideal mapping is: vetted enterprise AI as Approved, high-risk tools as Blocked, allowed-with-guardrails tools as Nudged with paste and upload controls, and under-review tools as Tolerated.
- Guide: Deliver real-time nudges at the moment of risk, paired with approved alternatives. When you direct people to a sanctioned tool, many will use it.
- Measure: Track your shadow AI adoption rate, risk-score trends, and nudge outcomes over time. These numbers show whether governance is working or just adding friction, and they map to the measure function in the NIST AI Risk Management Framework.
- Review: Revisit your classifications every quarter as tools and usage change. Any policy is only as useful as it is current, and a four-state model especially stays valuable only if it reflects what your workforce actually reaches for now.
This approach answers what the UpGuard team calls the shadow AI paradox. Employees adopt AI to be productive, not to cause harm, and security-awareness training alone doesn't curtail the behavior. Governance has to meet people in their workflow, not in an annual course.
How UpGuard helps you manage shadow AI
The UpGuard platform gives you visibility into shadow AI and the tools to govern it without slowing your teams down:
- User Risk: Discover shadow AI through in-browser telemetry, including tools that never touch your SSO. Correlate usage with risk scores and coach employees with in-workflow nudges the moment a risky action happens.
- The AI Security Center and Policy Toolkit: Generate usable AI policies and rollout kits tuned to your risk tolerance, so you can move from ad hoc rules to a governed program.
- State of Shadow AI report: Use the UpGuard research into workforce AI adoption to benchmark your exposure and build the case for governance with your leadership.
Start a free trial to see how the UpGuard platform surfaces and governs shadow AI across your workforce.
Frequently asked questions
These answers cover the shadow AI basics and governance questions that come up most often when teams start scoping the problem.
What does shadow AI mean?
It's the use of AI tools at work that your security or IT team hasn't approved or vetted. Any AI operating outside your oversight counts.
Is shadow AI the same as shadow IT?
Shadow AI is a type of shadow IT focused on AI tools and agents. Governance differs because data can leak through prompts and agent actions, not just stored files.
Is ChatGPT shadow AI?
Only when someone uses it for work without approval or oversight. A sanctioned, enterprise-governed deployment isn't shadow AI.
What are the biggest shadow AI risks?
Data leakage and compliance failure top the list, with unvetted MCP and agent connections close behind.
How do you detect shadow AI?
Through browser-based usage discovery, because SSO logs alone miss personal accounts and embedded AI features.
Should you block all AI tools?
No. Use four-state policies to approve safe tools, nudge risky behaviors, block high-risk apps, and tolerate new discoveries while you review them.
.jpg){kind=avatar}