The data exfiltration path that no tool catches is also the simplest. An employee reviews sensitive content on a work screen and dictates it to an AI assistant on their phone. No copy-paste event fires. No clipboard monitor triggers. No endpoint log records the action. The data left through the air, and every layer of the security stack missed it. This is not a theoretical edge case. It is one of several ways that AI-era data leakage systematically bypasses the detection infrastructure most organizations built for a different threat model.

Verizon’s 2026 Data Breach Investigations Report now classifies shadow AI as the third most common non-malicious data loss event in enterprise environments — a fourfold increase year-over-year. IBM’s 2025 Cost of a Data Breach found shadow AI involved in 20% of breaches at an average $670,000 cost premium. The exposure surface is broader than most governance conversations acknowledge. Anthropic’s own analysis of Claude usage found 35% of conversations are personal: health and wellness at 27%, relationships at 12%, personal finance at 11%. OpenAI’s NBER-partnered research found non-work ChatGPT usage exceeded 70% by mid-2025. Employees are using AI as a substitute doctor, therapist, and financial advisor — from work devices and corporate accounts — sharing information that organizations are responsible for governing under HIPAA, GDPR, and similar frameworks, often without knowing it is being shared at all.

Organizations Told Employees to Use AI Before Security Had a Framework

Most shadow AI did not begin as policy defiance. It began when leadership told employees to use AI to stay competitive, then left them to determine which tools, with what data, under what constraints. A Deloitte survey found 71% of workers use unapproved AI tools; 51% do so at least weekly. The same survey found 56% say they lack clear guidance despite policies ostensibly existing. Organizations created the demand, then failed to create a supply of sanctioned options that met it.

Even when organizations license enterprise AI platforms, shadow usage persists because no single sanctioned tool fits every workflow. A coding assistant that performs better at debugging, a writing tool that produces more polished output for a specific use case, a research tool that surfaces better sources — these will be adopted alongside or instead of the approved option. Copying text into a prompt does not feel like “sharing data” in the way attaching a file to an email does. It feels temporary, conversational, and low-risk. That perception gap between what the action feels like and what it actually does is where most exposure originates.

The personal data dimension compounds this in ways most organizations have not fully accounted for. Employees who use AI for personal topics — querying symptoms, working through a difficult situation, asking about finances — from work devices or corporate accounts expose organizations to privacy obligations they did not intend to incur. Pew Research found 22% of U.S. adults use AI chatbots for health information at least sometimes; 32% of those aged 18–29 do so regularly. A corporate AI account used to ask about a medical condition is processing health-adjacent data under a corporate identity, subject to retention policies the organization agreed to contractually, possibly in a system the organization has never audited for those purposes. Most organizations have not thought through the boundary between personal and organizational use in the accounts they provision, because the question did not exist when the accounts were created.

The Prompt Box Bypasses Every Control Traditional DLP Was Built For

Traditional data protection was built around discrete objects — files, records, databases. Controls focused on detecting when those objects were copied, moved, or shared improperly. Protect the container and you protect the data inside it. Generative AI breaks this model in several structural ways, and the gaps are architectural rather than configurational.

Within 20 days of allowing ChatGPT access to employees, Samsung Semiconductor engineers leaked proprietary data three separate times: one pasted source code to debug a bug; another submitted defect-detection algorithms for optimization; a third recorded an internal meeting and fed the transcript to ChatGPT for notes. Samsung banned all generative AI tools company-wide by May 2023. None of those actions involved a file transfer. All of them moved sensitive data to an external system through a path traditional DLP was never designed to see. The same scenario plays out daily: a support agent pasting a customer email thread to draft a reply, an engineer copying a stack trace to debug a production issue, a finance analyst pasting internal forecasts for analysis, a salesperson improving a proposal’s language. Each feels routine. Each moves sensitive data through a channel that looks like ordinary browser traffic.

AI tool traffic is standard HTTPS. A prompt submitted to an AI API is a POST request to a web endpoint — indistinguishable at the network layer from any other browser session. There is no file transfer, no unusual destination port, no binary blob that DLP signatures recognize. The prompt is the exfiltration, and the prompt is inside a TLS-encrypted POST body that network-layer inspection never sees. CASBs were designed for a generation of SaaS tools where data moved in structured objects; they have no mechanism to inspect the semantic content of a text prompt submitted to an AI API endpoint.

The cross-device dictation path has no technical fix at all. Employees do not only copy-paste from managed endpoints. They look at sensitive content on a work screen and dictate it to an AI on their phone or tablet. No clipboard event fires. No endpoint agent records the action. No network trace exists on any monitored device. This exfiltration path is invisible to every tool in the security stack because it requires no digital action on a managed device. Organizations with sophisticated DLP deployments have no sensor for what an employee says out loud.

Personal account usage closes a third gap. LayerX’s 2025 Enterprise GenAI Security Report found 71% of GenAI connections use personal, non-corporate accounts — invisible to CASBs configured around corporate identity. Browser extensions with high or critical permissions are present on more than 20% of enterprise devices and collect browsing context from internal systems outside monitored traffic paths. The 2026 DBIR specifically flagged AI browser extensions as an exfiltration pathway that organizations have largely not inventoried. Despite all of this, 89% of AI usage remains invisible to organizations despite existing security policies.

A second structural problem emerges even when data stays within sanctioned systems. AI is not a retrieval tool — it synthesizes, infers, and connects. A user with appropriate permissions across a dozen data sources can submit a query that surfaces insights no individual source was intended to reveal. A question drawing from HR records, project documentation, and communications can produce a synthesized narrative the organization never intended to be readable in aggregate. No permission was violated. The data never left. The internal knowledge structure has still been compromised. Least privilege was designed for access to objects. It was not designed for knowledge that becomes visible when those objects are read together by a model.

The Real Risk Is the Provider Nobody Evaluated

Most governance conversations about shadow AI focus on the well-known providers — ChatGPT, Claude, Gemini — which at least have enterprise offerings with documented data handling commitments and known security postures. The actual risk is concentrated in the long tail: hundreds of lesser-known AI providers operating with no enterprise controls, opaque training data policies, and no accountability mechanisms that enterprise security teams have reviewed or can enforce. Employees choosing AI tools for a specific workflow do not evaluate provider security posture. They evaluate speed, output quality, and convenience. A specialized coding assistant, a domain-specific research tool, a niche writing platform — these may handle sensitive enterprise data with no data retention commitments, no BAAs, no enterprise data processing agreements, and no mechanism to verify what happened to a prompt after it was submitted.

Cyberhaven tracked a 485% increase in corporate data pasted to AI tools between March 2023 and March 2024. Source code was the most common data type, followed by R&D materials and sales data. Reco AI’s 2025 analysis found unsanctioned AI tools persist in enterprise environments for a median of 403 days before detection. In most cases, by the time a tool is discovered, the forensics of what data entered it, what was retained, and whether it trained a model that someone else can now query do not exist. In May 2026, Community Bank became the first company to file a material cybersecurity SEC Form 8-K triggered by unauthorized AI use rather than an external attack: an employee processed customer names, Social Security numbers, and dates of birth through a personal AI account on a personal device. The organization reached the vendor in time to prevent the data from being used for model training. That outcome is the exception, not the norm. Italy’s data protection authority fined OpenAI €15 million in December 2024 for training data GDPR violations — a signal that regulators are now treating AI data handling as an enforcement priority, not a compliance gray area.

There is also a vendor supply chain dimension that procurement processes were not built to address. AI capabilities are being added to sanctioned SaaS products as incremental feature updates — an AI summarization feature in a project management tool, a writing assistant in a CRM, an AI analytics layer in a data platform. These additions happen through product update cycles, not through IT evaluation. An organization that approved a project management platform two years ago did not approve the AI assistant that platform shipped in its most recent quarterly update. The AI surface area within the approved vendor landscape is growing continuously, and existing vendor review processes have no mechanism to catch features added after procurement.

Agents Don’t Wait for a Human to Decide What to Share

Most current governance discussions center on conversational AI — a human types a prompt and receives a response. In that model, there is at least the opportunity for human judgment at each step. Agentic AI eliminates that checkpoint. Agents execute multi-step tasks autonomously: browsing the web, reading and writing files, calling external APIs, sending messages, interacting with internal systems. The agent decides what information it needs, retrieves it, and acts on it — often faster than any human review loop could realistically operate.

The first major breach directly attributable to an agentic AI deployment illustrates the difference in scale. In September 2024, Serviceaide — an agentic AI-based IT management vendor — exposed 483,000 Catholic Health patients’ records through a misconfigured database within its agentic AI infrastructure. Data exposed included Social Security numbers, medical record numbers, medications, clinical treatment details, and insurance data. The exposure window ran 47 days before detection. This was not an employee pasting data into a chatbot. It was an agent infrastructure processing regulated healthcare data at scale, without the oversight that would have been applied to a traditional IT deployment.

Agentic capabilities are already embedded in productivity suites, developer tools, and enterprise software — often enabled by default or added as incremental feature updates. An employee who connects an AI agent to corporate email, a file system, and a CRM through OAuth creates an autonomous workflow with access to data across multiple systems, running continuously, inheriting the permissions of the user who deployed it. The governance gap between what agentic capabilities can do and what organizations have evaluated them to do is frequently larger than the gap that existed when conversational AI first appeared — and it is growing faster.

Internal AI Breaks Least Privilege by Design

Much of the shadow AI conversation focuses on external exposure — data leaving the organization and entering a third-party system. That risk is real and important. But there is a parallel risk that receives far less attention: the erosion of internal knowledge boundaries by AI systems operating entirely within the organization’s own infrastructure.

Enterprise AI systems built on retrieval-augmented generation — where models are grounded in an organization’s own documents and data — can surface information in ways that exceed what any individual was ever intended to see. Consider an AI-powered internal assistant that indexes content broadly across the organization. An employee with broad but legitimate access submits a reasonable query and receives a synthesized response drawing from HR records, legal memoranda, M&A materials, and board communications. Each source is accessible to them individually. None were ever intended to be read together, contextualized, and summarized as a single narrative. No permission was violated. No data left the building. And yet the organization’s internal knowledge structure has been materially compromised.

Traditional access control was designed for objects and systems. It was not designed for the insights that emerge when many sources are read, compared, and synthesized by a model. Applying least-privilege thinking in this context requires asking a different question: not “does this user have access to these sources?” but “should this user be able to see what becomes visible when these sources are combined?” In practice, addressing this means rethinking how internal AI systems are scoped, how repositories are segmented for AI access, and what guardrails exist around synthesis and summarization — even when underlying permissions appear entirely correct.

Enterprise AI Reduces Risk. It Does Not Contain It.

In response to these risks, major AI providers now offer enterprise-grade versions of their models — with commitments that customer data is not used to train public models, clearer data retention and residency terms, identity and access controls, and administrative features intended to support governance. These capabilities matter. They create a substantially safer environment for AI usage and give security, legal, and privacy teams a foundation they can reasonably defend.

But the label “enterprise AI” covers a wide range of underlying commitments. Data residency guarantees, retention windows, fine-tuning and reuse rights, subprocessor chains, auditability, and logging capabilities vary significantly across vendors and offerings. A deployment that satisfies requirements in one dimension may fall short in another. CISOs should not assume that an “enterprise” designation translates into equivalent protections across providers, or that contractual assurances automatically align with internal risk tolerance.

More fundamentally, enterprise platforms do not prevent users from pasting sensitive data into prompts. They do not stop employees from dictating what they see on a screen to an AI on a personal device. They do not address the broader ecosystem of unsanctioned tools, embedded SaaS features, browser extensions, and agentic capabilities accessible with the same ease as any other web service. Enterprise AI meaningfully reduces risk. It does not contain it.

AI-Generated Output Is Also Unverified Input

Most discussions of shadow AI focus on data flowing into AI systems. Risk flows in the other direction as well. AI-generated outputs can introduce material exposure that is distinct from the data leakage problem and equally important for security-focused teams to understand.

Models hallucinate — producing confident, plausible-sounding content that is factually incorrect. When that material is incorporated into documents, communications, analyses, or decisions without verification, the result in legal, financial, and compliance contexts can be more than embarrassing: fabricated citations, incorrect figures, or misleading summaries create regulatory exposure, contractual risk, or formal misstatements. AI-generated code introduces a related surface: code produced by AI assistants may contain security flaws, rely on vulnerable dependencies, or implement logic that a developer accepts without the scrutiny they would apply to code they wrote themselves. When that code is deployed, the organization inherits whatever vulnerabilities it contains, often without a clear audit trail. AI-generated output should be treated with the same skepticism organizations apply to unverified external input — deliberately designed verification steps in high-stakes domains, not optional review in low-stakes ones.

Governing the Flow, Not the Tool, Is the Only Durable Strategy

Attempting to ban AI outright consistently fails. Verizon’s 2026 DBIR classifies shadow AI as a non-malicious insider action — employees trying to do their jobs better, not intentionally exfiltrating data. Policy-only approaches treat a productivity behavior as a compliance violation, which research consistently shows produces only temporary behavior change before usage migrates underground and organizational visibility decreases further. The behavioral evidence is precise: employees gravitate toward the tool that removes the most friction. Organizations that meaningfully reduce shadow AI make the sanctioned option faster and easier to use than the shadow alternative — same workflow integration, same output quality for the highest-risk use cases, frictionless onboarding. When the approved path competes on convenience, shadow usage declines not because it is prohibited but because it is unnecessary.

Detection must precede restriction. With 89% of AI usage invisible to organizations despite existing security policies, enforcing policy against an unobserved threat is impossible and drives risk underground. A detection architecture for AI-era data governance requires browser-level controls for prompt inspection — the only layer that can see what data entered an AI session — combined with network telemetry to identify AI destinations, OAuth and identity analysis to surface AI tools employees are authenticating to with corporate credentials, and browser extension auditing. No single layer covers the full surface. The cross-device dictation path has no technical detection at all, which is why data classification, employee guidance on what should never be shared with any AI regardless of device, and deliberate workflow design matter alongside technical controls.

The layered governance model is: clear data classification distinguishing what should never enter any AI system from what requires sanitization from what is generally safe; sanctioned enterprise AI for approved use cases; technical controls as guardrails at the browser and identity layer; vendor review processes updated to catch AI feature additions to existing SaaS products, not just new procurement; and regular review of which AI tools are actually in use. That last element requires ongoing effort, not a one-time audit — Reco AI found the median time from tool adoption to detection is 403 days. The strategic objective is not eliminating AI usage. It is making the shadow path expensive enough, and the sanctioned path easy enough, that the governance gap closes before an incident forces it.

The Data Is Already Leaving

The CISA acting director who uploaded FOUO-marked documents to public ChatGPT in July 2025 had both security expertise and a formal policy exception. The exception created the gap the controls would otherwise have closed. Samsung’s source code left the building through a debugging prompt. A community bank filed the first AI-related SEC material cybersecurity disclosure not because of an external attack but because an employee used a personal account to process customer data. These incidents span roles, industries, and levels of technical sophistication. The common element is not negligence — it is a governance structure that had not caught up to how AI is actually being used across the full spectrum of providers and interaction patterns.

The forensics reality is the part most governance frameworks have not yet internalized. Unlike a file transferred to Dropbox or an email sent to a personal account, data that enters an unmanaged provider’s training pipeline may be irrecoverable. There is no audit log to request, no deletion confirmation to obtain, no way to verify what was retained or whether it is now embedded in a model someone else can query. The 403-day median persistence figure means that in most organizations, the discovery of a shadow AI tool arrives long after the question of what data entered it has become unanswerable. The organizations that govern this well will not be the ones with the most restrictive policies — they will be the ones with the clearest view of where their data is actually going, and controls in place before something forces the question.

Sources

  1. Verizon, Data Breach Investigations Report, 2026
  2. IBM, Cost of a Data Breach Report, 2025
  3. Anthropic, “How People Ask Claude for Personal Guidance,” April 2026
  4. Anthropic, “Clio: Privacy-Preserving Insights into Real-World AI Use,” December 2024
  5. Anthropic, Economic Index Report, January 2026
  6. Chatterji et al., “How People Use ChatGPT,” NBER Working Paper 34255, September 2025
  7. LayerX, Enterprise GenAI Security Report, 2025
  8. Reco AI, 2025 State of Shadow AI Report
  9. Cyberhaven, AI Adoption and Risk Report, 2025
  10. Menlo Security, 2025 Shadow Generative AI Report
  11. Deloitte UK, AI Workplace Survey, 2025
  12. Pew Research Center, “Users of social media and AI chatbots for health information,” April 2026
  13. Zluri, State of AI in the Workplace Report, June 2025
  14. Wilson Sonsini, “Shadow AI Triggers First SEC Form 8-K,” May 2026
  15. HIPAA Journal / HHS, Serviceaide / Catholic Health data breach disclosure, May 2025
  16. Garante (Italy), OpenAI GDPR enforcement decision, December 2024