What is shadow AI? Definition, risks, examples and detection
In short
- Shadow AI is AI usage without the knowledge or approval of IT and security. It includes ChatGPT in the browser, Copilot features in Office, browser extensions, local models, coding agents and AI features inside SaaS products that were approved long ago.
- The risk lies in the data that leaves the company along the way, and in actions that agents perform without oversight.
- There are three ways to discover shadow AI: network logs, surveys, detection on the device. Only the third sees local models, extensions and agents.
Definition
Shadow AI describes the use of AI tools, AI models or AI features embedded in software inside an organization, without IT or security teams knowing about it or approving it. The term derives from shadow IT but differs in two respects: AI usage spreads faster because it needs no installation, and it often lives in tools that were approved long ago.
The line between regular usage and shadow AI is approval, not the tool. The same ChatGPT can be approved in one company and shadow AI in the next.
What counts as shadow AI
| Category | Examples | Why it is often missed |
|---|---|---|
| Chat tools in the browser | ChatGPT, Claude, Gemini, Perplexity via a private account | the domain is known, the content is not |
| Embedded AI features | Copilot in Office, assistants in CRM, ticketing and design tools | the product is approved, the AI feature arrived in an update |
| Browser extensions | summarize, translate, write, review | send page content to third-party services, look like ordinary HTTPS |
| Developer tools | IDE assistants, coding agents in the terminal, MCP servers | run as processes, access files and internal APIs |
| Local models | Ollama, LM Studio, models built into apps | produce no network traffic |
| Custom integrations | scripts with API keys, no-code automations | run under one person's account |
Why shadow AI is a risk
Data leaves the company. A prompt is an upload. Customer data, contract drafts, source code and credentials travel into a context window and from there, depending on provider and account, into logs or training data. With private accounts there is no data processing agreement and no legal basis under GDPR.
Agents act without oversight. A coding agent reads files, calls APIs and writes results. An MCP server gives an assistant access to mail or a database. These actions run with the user's permissions, at machine speed, and appear in no log security knows about. More in the post on MCP as an attack surface.
Nobody can answer questions. Since 2025 the EU AI Act requires AI literacy across the workforce (Article 4) and, for many systems, records of operation. If you do not know which AI systems run, you can neither train nor log. The AI Act solution page describes which obligations presuppose an inventory.
Vulnerabilities in tools. AI features bring their own weaknesses, such as prompt injection through content they read. The case of CVE-2026-24301 in Copilot shows how a privately used assistant becomes an entry point.
Why the existing stack does not see it
Firewall, web proxy and CASB work at the network edge and see destinations: domains, IPs, data volumes. They do not see what a prompt contains, they see no browser extension, no local model and no agent action on the device. The post Why your firewall, proxy and CASB miss AI tools running on laptops describes these four blind spots in detail.
Three ways to discover shadow AI
| Approach | What it sees | What it does not see | Effort |
|---|---|---|---|
| Network and CASB logs | calls to known AI domains, data volumes, accounts with API integration | prompt content, extensions, local models, agents, devices outside the proxy | low, the data usually exists |
| Surveys and licence audits | approved tools, what employees report, purchased licences | everything nobody reports, private accounts, usage arriving via updates | medium, imprecise |
| Detection on the endpoint | actual usage per device: tool, process, frequency, content type if needed; local models, extensions, agents | nothing outside the devices it runs on | installation per device, then automatic |
In practice the approaches complement each other. The logs give a first impression, the survey explains the demand, the measurement on the device delivers the truth. Anyone relying on the first approach alone regularly underestimates usage, because exactly the quiet channels are missing.
An inventory in five steps
- Pick a sample. Ten to fifty devices across departments, development included.
- Measure for two weeks. Detection on the device that only observes and does not intervene. Patronus Monitor does exactly that and is free.
- Sort the result. Per tool: how many devices, how often, which kind of content (text, code, documents).
- Set a rule per tool. Allow, allow with redaction of sensitive data, block. For agents additionally: which actions need approval.
- Offer an approved alternative. A blocked tool without a replacement leads to usage on private devices. If you block ChatGPT, offer an approved path.
The rules are then enforced on the device by the full version, Patronus Protect: redact, block, log, per tool and data type.
Shadow AI and shadow IT: the difference
Shadow IT was servers under desks and cloud storage paid with a company credit card. It was visible if you looked: an invoice, a device, a domain. Shadow AI is a feature in a tool that is already there, a tab in the browser or a process on the laptop. It leaves few traces at the network edge and switches tools faster than a domain list can be maintained. That is why the answer from back then, block lists at the gateway, no longer works here.
Sources and further reading
- Shadow AI: blind spots in the existing security stack
- Why your firewall, proxy and CASB miss AI tools running on laptops
- Shadow AI discovery solution page
- EU AI Act, Article 4 (AI literacy): https://artificialintelligenceact.eu/article/4/
- As of September 7, 2026.
FAQ
Frequently asked questions
What is shadow AI in one sentence?
Shadow AI is the use of AI tools, models or AI-powered features inside an organization without the knowledge or approval of the IT and security teams.
Which tools help discover shadow AI in an organization?
Three approaches: CASB and proxy logs (they see SaaS domains, not prompts or local models), surveys and licence audits (they see what people admit to), and endpoint-level detection (it sees actual usage, including local models, extensions and agents). Patronus Monitor takes the third route and is free.
Is shadow AI illegal?
No. Shadow AI is a state, not a violation. Violations arise when personal data goes to third parties without a legal basis (GDPR), when trade secrets leak, or when AI systems are operated without meeting the obligations of the EU AI Act. The goal is visibility followed by a rule, not a ban.
Why doesn't our existing security stack see shadow AI?
Because firewall, proxy and CASB see domains and data volumes, but no content, no browser extensions, no local models and no agent actions. These four blind spots can only be closed on the device.
How do I start a shadow AI inventory?
With a measurement instead of a survey. Install detection on a sample of devices, let it run for two weeks, and you have a list of the tools actually in use with frequencies. Then decide per tool: allow, allow with redaction, block.