Shadow AI is the use of AI tools, models or browser extensions by employees without the knowledge or approval of IT or security. In practice it means staff pasting source code, customer records and credentials into ChatGPT, Claude, Gemini and whichever tool launched last week, from a browser tab that none of your existing controls can see inside.
The UK's National Cyber Security Centre put it plainly in September 2026: "Shadow AI describes the use of AI technology which isn't captured in an organisation's approved systems and processes." It cited a Microsoft UK study in which 71% of employees said they use AI tools their employer has not approved. The NCSC's title, "The hidden risks of shadow AI", is right in one specific way: the risk is hidden from the tools you already own. Network data loss prevention sees an encrypted session to an AI vendor and nothing more. Endpoint agents see a browser process. Cloud access brokers see a sanctioned or unsanctioned domain. None of them sees the paste.
This article is for the security leader who has to answer three people at once: the board asking whether company data is leaking into AI tools, the data protection officer asking what any monitoring would do to employee privacy, and the staff who want to use these tools because they work. It covers what actually leaks, why the usual controls miss it, and how a control can see the paste without reading it.
What is shadow AI?
Shadow AI is the AI-specific form of shadow IT: technology adopted by employees outside the organisation's governance. Three things make it worse than the SaaS sprawl of the last decade.
- The input is the data. A shadow SaaS app holds data you put in a form. A chat assistant takes whatever is pasted into a text box, and the fastest way to get a useful answer is to paste the real thing: the actual contract, the actual log, the actual customer email.
- It is free and instant. No procurement, no install, no admin. A work email address and a browser tab.
- The tool set changes weekly. Blocking three domains was a strategy in 2023. It is not one now.
Is ChatGPT shadow AI? Not by itself. ChatGPT used through an enterprise agreement, with the data terms your DPO signed off, is sanctioned AI. The same product used through a personal account on a work laptop, with the default data settings, is shadow AI. The tool is the same; the governance is not.
What actually leaks
The pattern from public incidents and from what security teams report is consistent. In rough order of frequency:
- Source code. Developers pasting functions to debug, refactor or document. The best-known public case is Samsung in 2023, where engineers pasted proprietary code into ChatGPT and the company restricted the tool afterwards (reported by Bloomberg, May 2023). Code often carries embedded secrets.
- Credentials and API keys. Usually by accident, inside a config file, a log excerpt or an error message pasted whole.
- Customer records. Support and sales staff pasting a ticket, an email thread or a CRM export to draft a reply or summarise a case.
- Commercial and legal documents. Contracts, board papers, financial models pasted for summary or redrafting.
- Project codenames and unannounced plans. Low volume, high consequence.
Two things follow. The person doing this is almost never malicious; they are trying to do their job faster. And the sensitive part of the paste is usually a small fraction of it: one key, one name, one clause. Any control that treats the whole paste as the problem will be fought by the people it is meant to protect.
What the risks are
What are the risks of shadow AI? Four, in the order a board will ask about them.
- Data leakage. Content pasted into a consumer AI tool may be retained, used to improve models, visible to the vendor's staff, or exposed in a breach of the vendor. In July 2025 Fast Company found around 4,500 shared ChatGPT conversations in Google search results, and a researcher later scraped nearly 100,000 of them, including NDAs and confidential contract discussions; users had ticked a "make this chat discoverable" option when sharing a link. OpenAI removed the option within days and called it "a short-lived experiment" (Fortune, 5 August 2025).
- Regulatory exposure. The ICO defines a personal data breach as "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data", and lists sending personal data to an incorrect recipient as one type. Pasting a customer's details into a consumer AI tool with no processor terms in place fits that definition. What follows is an assessment, not an automatic report. If the breach is likely to result in a risk to people's rights and freedoms, you must report it to the ICO "without undue delay, but not later than 72 hours after becoming aware of it". If the risk is unlikely, you need not report it but must document why. Either way the first thing you need is to know it happened, and most organisations cannot.
- Contractual exposure. Customer contracts and NDAs routinely forbid sharing their content with third parties. An AI vendor is a third party.
- Security exposure. The reverse direction: a malicious or compromised AI tool, or a lure dressed as an AI onboarding step, is now a recognised initial-access route. The ClickFix family includes AI-tool onboarding lures aimed at organisations with public AI initiatives.
Why the tools you already have cannot see it
| Control | What it sees | What it misses |
|---|---|---|
| Network DLP / secure web gateway (Zscaler, Netskope, Palo Alto, Cisco, Cloudflare) | The prompt, but only after decrypting the session and inspecting it in the vendor's cloud. Each vendor's own DLP documentation describes cloud-side inspection; Cloudflare's states that DLP "requires Gateway HTTP filtering with TLS decryption" | Anything on a device not steered through the proxy; and the prompt itself is processed in the vendor's cloud |
| CASB / SaaS discovery (Defender for Cloud Apps) | Which AI domains are in use, by whom, how often; can block unsanctioned ones by domain | Whether anything sensitive went in |
| Endpoint DLP (Microsoft Purview, Symantec, CrowdStrike) | A paste into an AI site, in supported browsers. Microsoft Learn (26 Jun 2026): Purview in Edge natively, in Chrome via a Windows-only extension, macOS paste control in preview. Broadcom's knowledge base: Symantec monitors clipboard "in Chrome or Edge browsers" only | Unsupported browsers and platforms; Microsoft Learn states that Purview's advanced classification and evidence collection use the cloud service |
| Domain blocking | Stops the three domains you listed | The fourth tool, and the personal-account route to the first three |
| Enterprise browser (Island, Prisma Browser) | Everything typed or pasted, in principle. Island's documentation says data "can be inspected before it ever leaves the browser"; Palo Alto's says Prisma Browser's data controls use its cloud Enterprise DLP profiles | Adoption: staff keep using the browser they have, and it is a second browser to run |
| Browser extension sensors (Push, LayerX, Harmonic, Nightfall, Menlo) | The paste, at the point it happens, in the browser the staff already use | Privacy varies sharply, in the vendors' own words: Harmonic's documentation says the extension "does not analyze prompts locally" and stores prompt text for 180 days; Menlo's says "the Menlo architecture replicates each browser session in the Menlo Cloud"; LayerX's says "the only data that is sent to the LayerX cloud is alerts" |
| SenseOn Universal Sensor in the browser (in design) | The paste, on the device, with only the verdict leaving | Copying text out to somewhere else; a determined user can still do that |
The honest summary: to see a paste into an AI chat you have to be in the tab. The question is what you do once you are there, and that is a privacy question before it is a security one. (Vendor statements above are quoted or summarised from each vendor's own public documentation, read on 19 September 2026: Cloudflare One DLP docs; Microsoft Learn Purview endpoint DLP pages; Broadcom knowledge base article 261794; Island "Enterprise DLP for generative AI"; Palo Alto Prisma Browser data-control docs; Harmonic Security docs; Menlo Security product pages; LayerX "extension vs Talon" page. The dated source list is on the browser sensor page.)
The privacy problem with "inspect everything"
The obvious design is to send what the user typed to a cloud service and inspect it there. Some products do this. For a UK or European employer it is a poor answer.
- It means the employer is reading employees' words, including personal ones, in a tool they may also use for personal tasks.
- It creates a second copy of every sensitive paste, in a second vendor, which is the exact problem you set out to solve.
- It is the design a works council or a DPO is most likely to challenge, and the hardest to justify in a DPIA, because a less intrusive means exists.
That less intrusive means is on-device analysis. The text is examined inside the browser on the employee's own machine, against a bounded set of rules (secret and credential patterns, sensitive keywords), and only the verdict leaves: "a credential-shaped string was entered into an AI composer on this domain at this time." The content never leaves. The employer learns that something happened, not what was said. Under UK GDPR this is the difference between monitoring that can be shown to be necessary and proportionate and monitoring that looks like blanket surveillance, and it is the strongest line a DPIA for this control can carry.
What the Universal Sensor will do in the browser
Everything in this section describes intended design; availability and timing will be announced separately.
SenseOn is extending the Universal Sensor, the agent that already collects endpoint and network telemetry, into the browser with a managed extension that will be deployed through your existing enterprise browser policy. For shadow AI it is designed around three choices.
Private by design. All content analysis will run on the device. Only a verdict will leave the browser. Where a customer explicitly opts in, a minimal redacted snippet may accompany a confirmed violation; by default, raw content will not be transmitted or stored. URLs will be reduced to the registrable domain before any event is built. User identity will be configurable per deployment: full email, domain only, or anonymous. This is a design choice, not a setting.
Guide, do not obstruct. When a credential, API key, project codename or other sensitive content is entered into an AI chat window, the sensor will warn the user in the moment. In composer mode it will block only the send action, leaving the text editable, so the user removes the offending line and carries on. Warning is the default; blocking is something the security team turns on deliberately, per tenant, and it can be turned off again. Nothing enforces silently.
Centrally controlled, both directions. Rules will be set centrally: "warn anyone pasting a credential into an AI chat", "block this known-malicious AI domain". Known-bad AI and SaaS destinations will be blocked at the network layer before the page loads. And the same sensor will watch the other direction, threats coming in through the browser, so a data-leak warning and a lure neutralisation will land in the same SenseOn investigation alongside endpoint, network and identity signals.
Telemetry will flow in OCSF into the existing SenseOn pipeline, so there is no new stack to run and no new vendor holding a copy of your data.
How to avoid shadow AI: a five-step programme
How to avoid shadow AI? You cannot, and the organisations that try end up with more of it. The goal is to govern it.
- Provide a sanctioned option. An enterprise AI agreement with data terms your DPO has approved removes most of the reason to go around you.
- Write an AI acceptable use policy people can follow. One page. What is allowed, what is not, and the one rule that covers most cases: never paste customer data, credentials or unreleased code into a tool that is not on the approved list.
- See before you block. Deploy any control in warn-only mode first. Measure for a full business cycle. The volume and the categories of what staff paste will change the policy.
- Keep the content on the device. Choose controls that analyse locally and export verdicts. Document that choice in the DPIA; it is the strongest line in it.
- Correlate. Shadow AI signal is most useful next to identity and endpoint signal. A credential warning on a machine that then shows an unusual sign-in is a different case from a credential warning alone.
Frequently asked questions
What is shadow AI? The use of AI tools, models or browser extensions by employees without IT or security approval. It is the AI form of shadow IT, and its distinguishing risk is that the input to the tool is the organisation's own data.
What is AI shadow? The same thing; "AI shadow" and "shadow AI" are used interchangeably.
Is ChatGPT shadow AI? Only when used outside the organisation's governance, for example through a personal account with default data settings. The same tool under an enterprise agreement with approved data terms is sanctioned AI.
Can you block ChatGPT at work? You can block the domain. Staff then use a personal device, a different tool, or a personal account on a domain you allowed. Warning at the point of paste, with a sanctioned alternative available, works better than a block list.
Does monitoring AI use breach employee privacy? It depends on the design. Inspecting the content of what employees type is intrusive and hard to justify under UK GDPR when a less intrusive means exists. Analysing on the device and exporting only a verdict is that less intrusive means, and the one to document in a DPIA.
Sources and further reading
- NCSC, "The hidden risks of shadow AI" (7 Sep 2026)
- ICO, "Personal data breaches: a guide" (ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/)
- ICO, "Employment practices and data protection: monitoring workers" (ico.org.uk)
- Fortune, "OpenAI removes ChatGPT feature after private conversations leak to Google search" (5 Aug 2025)
- SenseOn Docs, ClickFix defence guide for the AI-onboarding lure variant.
Capability statements about the Universal Sensor's browser coverage describe intended design.
