Shadow AI: How Enterprise Data Leaves the Control Boundary

A support engineer pastes a customer's error log into a chat window to get the stack traceThe printout a program produces when it fails, listing the chain of calls that led to the failure. Engineers pass them around constantly, because the trace is the fastest available description of what went wrong — and it routinely carries fragments of whatever the program was handling at the time. explained. The log contains an API key: a credential that works for whoever holds it. That single act — competent, well-intentioned, invisible — is the whole of Shadow AI, and every structural feature of the problem follows from the fact that nothing about it looks like misconduct.

Cloudflare found 104 of those keys sitting in its own Salesforce support cases after an attacker exfiltratedCopied data out of a system to somewhere the attacker controls. The word exists because "stole" misleads: the original is still sitting there, intact and apparently untouched, which is a large part of why the theft goes unnoticed. them in August 2025. The company had never asked customers to paste secrets into a ticket. Customers did it anyway, because pasting the whole log is faster than redacting it, and because a support case has always felt like a private channel. Cloudflare's own disclosure of 2 September 2025 says it plainly: "Cloudflare does not request or require customers to share secrets, credentials, or API keys in support cases. However, in some troubleshooting scenarios, customers may paste keys, logs, or other sensitive information into the case text fields."

Substitute a chat interface for the support ticket and you have the subject of this primer. The mechanism is identical — a human being moving text into a system because moving text is what the job requires — but the destination is no longer a database under someone else's access control. It is a processing pipeline that may retain the text, sample it for human review, embed it in a vector index (a searchable numeric representation of what the text means), hand it to a subprocessor (the vendor's own supplier, working under the vendor's contract rather than yours) in another jurisdiction, or fold it into the weights of a model that cannot subsequently be unlearned. The weights are the adjustable numbers in which a model holds what it has learned. Shadow IT — the older problem of staff adopting software procurement never approved — moved data to an unsanctioned place. Shadow AI moves it into an unsanctioned process. The difference is not rhetorical. A place can be inventoried and emptied. A process, once it has run, generally cannot be reversed.

Everything else in this document follows from that distinction: why blocking underperforms, why detection is structurally hard rather than merely under-resourced, why the highest-performing teams generate the most exposure, and why an organisation that succeeds at rolling out sanctioned AI ends up with a larger total surface than one that failed — a result that reads as paradoxical until the mechanism is on the table, and as arithmetic afterwards.

What follows is built to be read once, in order. Part I assembles the mechanism from the employee's keystroke to the model provider's retained corpus. Part II works out what breaks — legally, contractually, and in the incident-response sense — using documented cases rather than hypotheticals. Part III looks at where the surface is moving, and at the one question nobody can yet answer: whether this ends the way Shadow IT largely did, absorbed into governance, or whether free, capable, invisible tools make a permanent gap the stable state.

The analyst has a 40-page vendor contract and ninety minutes before the call. The sanctioned summarisation tool is in procurement. The unsanctioned one is one browser tab away, free, and will produce a usable summary in eleven seconds.

The received framing — unauthorised software, solved by a policy and a block list — misreads the driver. Employees are not evading controls. They are closing a gap between what the job demands and what the sanctioned toolset delivers, on a clock, and the closing move happens to route data out of the building. Nothing in the experience signals a boundary crossing. There is no download, no installer, no admin prompt, no file on disk.

The best independent measurement of this is not a vendor's. Professor Nicole Gillespie and Dr Steve Lockey of Melbourne Business School, working with KPMG, surveyed more than 48,000 people across 47 countries between November 2024 and January 2025. Three in five employees (58%) intentionally use AI at work, a third weekly or daily. Almost half admit to use that contravenes company policy — including, in the researchers' own words, "uploading sensitive company information into free public AI tools like ChatGPT." Fifty-seven per cent conceal their use and present AI-generated work as their own. And 40% say their workplace has any generative-AI policy or guidance at all.

Put those four numbers together and the shape of the problem changes. A workforce where half the AI use breaches policy and 60% of workplaces have no policy does not have a compliance problem. It is operating in the absence of instruction, and filling the vacuum with judgement. The concealment figure should worry a security team most, because it means the population most likely to be doing something consequential is also the population least likely to appear in a survey, an amnesty, or a self-declaration exercise.

Microsoft and LinkedIn's 2024 Work Trend Index — Edelman Data & Intelligence, 31,000 knowledge workers, 31 markets, fielded 15 February to 28 March 2024 — found the same behaviour from the other direction: 75% of knowledge workers use AI at work, "78% of AI users are bringing their own AI tools to work," and "52% of people who use AI at work are reluctant to admit to using it for their most important tasks." Not their trivial tasks. Their most important ones.

Calling this carelessness confuses two things. The employee is usually optimising exactly the variable their manager is measuring — throughput — and the data-handling consequence is not on the scoreboard. And the tool is genuinely better at the task than the alternative in front of them. Cisco's 2025 Data Privacy Benchmark Study — 2,600 privacy and security professionals across 12 countries, published 2 April 2025 — captured the resulting tension inside a single population: 64% of respondents worry about "inadvertently sharing sensitive information publicly or with competitors," and "nearly half admit to inputting personal employee or non-public data into GenAI tools." These are the same people. They know the risk and they do it anyway, because on any given Tuesday the risk is abstract and the deadline is not.

If the driver is a capability gap under time pressure, a control that only forbids will displace the behaviour rather than end it. The only durable lever is to make the sanctioned path faster than the unsanctioned one — an uncomfortable finding for a security function, because "faster" is not a security deliverable and rarely sits in a security budget.

"Using AI" is a phrase that flattens eight unrelated risk mechanisms into one. A browser extension, an IDEIntegrated development environment — the editor a programmer writes code in. Its AI autocomplete sees the file being edited and usually a good deal of the surrounding project, which is what makes it a data path rather than a typing aid. autocomplete, an OAuth grant to a mailbox, and a chat window differ in what data they touch, what they leave behind, who holds the far end, and which control — if any — can observe them. Treating them as one category is the reason so many programmes report high policy coverage and low actual visibility.

Start with the simplest and work outward. A consumer chat interface on a managed deviceA laptop or phone the employer owns and administers — enrolled in its device-management system, running its software, subject to its policies. The distinction runs through this whole report: an unmanaged device is one the employer has nothing installed on, and therefore no view into. is a browser session to a legitimate, well-known domain over TLSTransport Layer Security — the encryption behind the padlock in the browser bar. It conceals the contents of a session from everything in between, including the employer's own network monitoring. The name of the site stays visible; what was typed into it does not.. A secure web gatewayA network control sitting between the workforce and the internet, inspecting and filtering outbound web traffic. It can permit or block a destination. Seeing inside an encrypted session requires decrypting it first, which is a separate and expensive decision. sees the hostname. It does not see the prompt unless the organisation decrypts the session, and decryption breaks a growing share of applications. A personal account on an unmanaged device — the employee's own laptop at home, the phone in their pocket — produces no enterprise telemetry at all. It is not that the control is weak. There is no control.

Browser extensions are the path most often missed, and the one where the permission model does the damage. A Cloud Security Alliance research note published 11 April 2026 records that 53% of enterprise-installed extensions can "read and change all your data on the websites you visit" — a grant that authorises keystroke capture, session content extraction and content injection across every application the user touches, accepted with a single click and no admin in the loop. Drawing on LayerX's browser telemetry, the note reports that over 20% of enterprise users have installed a generative-AI-specific extension, 58% of those carry high-risk permissions, more than 5% have been independently classified as malicious, and 26% were sideloadedInstalled directly onto the browser, bypassing the official extension store and whatever review that store performs. A sideloaded extension has been vetted by nobody at all. from outside official stores. It also names two campaigns: two Chrome extensions impersonating the legitimate AITOPIA tool accumulated roughly 900,000 installs and exfiltrated complete ChatGPT and DeepSeek conversation histories from more than 20,000 enterprise tenants in January 2026; a fake free-VPN campaign harvested AI conversations across eight million installations in December 2025. The extension does not need to intercept traffic. It is already inside the rendered page, on the trusted side of the encryption, reading the prompt as the user types it.

Unmanaged API keys and personal developer accounts move the problem into the codebase. GitGuardian's State of Secrets Sprawl 2026 counted 28.65 million hardcoded secretsPasswords, API keys, tokens and certificates written straight into source code, rather than held in a vault the code calls out to. They work perfectly, which is why developers do it — and they travel with the code into every copy, branch and backup made afterwards. added to public GitHub during 2025, up 34% year on year, and 1,275,105 leaked secrets tied specifically to AI services — an 81% annual increase, with eight of the ten fastest-growing detector categories now AI-related. Internal repositories were roughly six times more likely than public ones to contain hardcoded secrets. Two findings from that report matter more than the headline counts. First, 24,008 unique secrets were exposed in Model Context ProtocolUsually shortened to MCP: an open standard for connecting an AI assistant to outside tools and data sources. Think of it as a common plug shape, so that any assistant can talk to any system that speaks it. Its configuration files hold the credentials for those connections, which is why they turn up in a census of leaked secrets. configuration files within the protocol's first year, of which 2,117 were confirmed valid — a new file type, created by the agentic wave, that developers immediately began filling with live credentials. Second, roughly 28% of secret-leak incidents originate outside repositories entirely, in Slack, Jira and Confluence, and those leaks are 13 percentage points more likely to be graded critical. Credentials do not only leak through code. They leak through conversation.

IDE and coding assistants occupy an awkward middle position: sanctioned in most engineering organisations, and operating on the most concentrated intellectual property the company owns. GitGuardian's measurement here is uncomfortable: commits assisted by Claude Code showed a 3.2% secret-leak rate against a 1.5% baseline across all public GitHub commits. That is not an argument against coding assistants; developers still choose what to accept. It is evidence that generation speed and review attention are not scaling together.

OAuth grants to corporate SaaS are the door with the highest blast radiusHow much is reachable once a single thing goes wrong. A narrow blast radius means the damage stops at one mailbox; a wide one means one compromised grant opens everything that grant could touch., because the grant is durable, silent, and carries the user's own authority. An OAuth grant is what sits behind the “allow this app to access your account” button. The user is not handing over a password; they are handing over a token that acts with their authority, on whatever the app asked for, for as long as the token exists. It does not lapse when the task that prompted it is finished. It lapses when somebody revokes it. Push Security, analysing its customer telemetry after the Vercel breach, reports seeing "17 unique AI app integrations per organization" in Microsoft and Google environments alone, against one or two AI apps typically approved for business use. Material Security puts the structural point plainly: "At the OAuth grant layer, an MCP-connected agent produces the same telemetry as a traditional SaaS app." A grant-review process built to score static attributes — publisher, scope, install count — cannot distinguish a fixed-purpose integration from an agent whose behaviour is decided at inference time by whatever text lands in its context.

The default that makes this possible is Microsoft's own. Its Entra guidance, last updated 4 August 2026, states that "By default, all users are allowed to consent to applications for permissions that don't require administrator consent" — a user can authorise an application to read their mailbox without an administrator seeing it. It also names the reason old grants outlive their governance: "Any updates to user consent settings only affect future consent operations for applications. Existing consent grants remain unchanged, and users continue to have access based on the permissions previously granted." Tightening the policy tomorrow does nothing about the integration a departing employee authorised in 2023. Spin.AI, auditing what it describes as 550,000-plus apps and extensions in early 2026, reports that "64% of third-party applications now access sensitive data without business justification," up from 51% the previous year, and puts unsanctioned SaaS at 65% of applications in use. That figure carries a vendor's interest and no disclosed sampling frame; it is directionally consistent with Push Security's independent count of 17 AI integrations per organisation against one or two approved.

Embedded LLMLarge language model — the kind of system underneath a chat assistant: trained on very large quantities of text, and able to continue, summarise or transform any text put in front of it. Where this report says "the model", this is what it means. features inside already-approved software are the category that defeats procurement outright, because there is nothing to procure. A note-taker, a CRM, a design tool or a helpdesk that was reviewed and approved in 2023 ships an AI feature in 2025 and begins processing the same data through a new pipeline under the same contract. Zscaler's telemetry gives a sense of the scale: across its 2025 measurements, Grammarly accounted for 3,615 terabytes of enterprise data transfer to AI and machine-learning applications — more than ChatGPT's 2,021 TB. Very few AI-governance programmes have Grammarly at the top of their risk register.

Finally, agents holding delegated credentials, which Section 6 takes on its own terms. For now the taxonomy is enough, because the taxonomy is what makes the visibility problem legible.

Is any of this genuinely new, or is it Shadow IT with a fresh interface? Partly. The acquisition dynamic is identical — a capable tool, free at the point of use, adopted bottom-up ahead of procurement. Three things are different, and only three. Data entering an AI service enters a transformation pipeline rather than a storage location, so the remedies available for a rogue file-share (inventory it, pull it back, delete it) do not map. The tool can be instructed by content it reads, which no Dropbox account could. And the interaction leaves no file artefact, because a paste is not a transfer in any sense a legacy data-loss-prevention product was built to recognise. Everything else about Shadow AI really is Shadow IT, and the parts that are the same are the parts organisations already know how to fix.

Ask a security team what they fear employees are pasting and the answer is usually customer personal data. The measurements say something different, and the difference matters for where controls should point.

Harmonic Security analysed 22,458,240 enterprise generative-AI prompts and file uploads across 665 tools between 1 January and 31 December 2025, identifying 579,113 instances of sensitive data. Code and technical intellectual property accounted for 26.5% of exposures (175,406 instances). Legal documents accounted for 22.3%. Merger-and-acquisition material accounted for 12.6%. Code, legal and financial material together made up 74.5% of everything exposed. Within coding tools specifically, 12.8% of exposures contained an API key or token. Six applications accounted for 92.6% of all sensitive-data exposure, and ChatGPT alone for 71.2% of measured risk.

That composition is a different problem from a personal-data problem. Deal terms, litigation strategy, unreleased source code and board material are not regulated categories with a notification clock; they are the assets the company competes on. A regulator will not necessarily care. A competitor would.

The other measurements agree on direction and disagree usefully on magnitude. Cyberhaven, working from endpoint and SaaS telemetry it describes only as "billions of real-world data movements," reports that 39.7% of all data movements into AI tools involve sensitive data, and that the average employee puts sensitive data into an AI tool once every three days. LayerX, measuring inside the browser, found in its Enterprise AI and SaaS Data Security Report 2025 that 77% of users paste data into generative-AI tools, that 22% of those pastes contain personally identifiable or payment-card data, that 40% of files uploaded to generative-AI apps contain PII or PCI data, and that employees average 14 pastes a day from non-corporate accounts, "of which at least 3 contain sensitive data." Netskope's 2026 telemetry records an average of 223 generative-AI data-policy violations per organisation per month, rising to about 2,100 in the top quartile, with the violated categories being source code, confidential data, intellectual property and login credentials.

The form the data takes determines which controls can act. A file upload has a file: it can be scanned, labelled, and blocked by object. A paste has no object. It is a clipboard event and then a form submission inside an encrypted session, which is why LayerX's own recommendation is to move data-loss prevention from file-centric to action-centric — and why, as Section 7 shows, the enterprise tooling that can do that is narrower than most buyers assume.

And then there is the form nobody classifies: prose. Cloudflare's 104 API tokens were not in an upload. They were in the body text of support cases, typed by customers who were troubleshooting.

The single most consequential fact about a prompt is which tier it was typed into. Not which company. Which tier. The same provider, the same model, the same interface will treat the same sentence in materially different ways depending on whether the account was free, personal, team or enterprise — and the gap between tiers is wider than the gap between vendors. A tier is the account class the user signed up under, and it is a contractual object rather than a technical one. The software on the other end does not change. What changes is which document governs the words: a terms-of-service page somebody clicked through in thirty seconds, or an agreement an employer's lawyers negotiated.

Anthropic ran the clearest natural experiment in the industry. On 28 August 2025 it announced that it would "train new models using data from Free, Pro, and Max accounts when this setting is on," and would be "expanding our data retention period to five years if you allow us to use your data for model improvement," with users required to choose by 8 October 2025. Decline, and the retention period stays at 30 days. The current consumer article, effective 16 March 2026, confirms the shape: Anthropic uses chats and coding sessions to improve models "if you choose to allow us," with Incognito chats excluded even when model improvement is on, and feedback data stored "in our secured back-end for up to 5 years." Against that, the Commercial Terms of Service, effective 17 June 2025, are unambiguous in the other direction: "Anthropic may not train models on Customer Content from Services," with the customer retaining all rights to inputs and owning outputs. Same company, same model, opposite default — decided entirely by which button the employee clicked when they signed up.

Google shows the same split with a sharper edge on retention. The Gemini Apps privacy hub, last updated 10 August 2026, states that a subset of chats are reviewed by human reviewers "to help improve Google services," and that chats reviewed by human reviewers "are not deleted when you delete your activity. Instead, they are retained for up to three years." With Keep Activity off, conversations are retained for 72 hours for service provision and abuse protection, and future chats are not used to improve models absent feedback. Now compare the Workspace privacy hub, last updated 14 August 2026: "Workspace does not use customer data for training models without customer's prior permission or instruction"; chats and uploaded files "won't be reviewed by human reviewers or otherwise used to train generative AI models without your permission"; retention is admin-determined, from 90 days to indefinite. An employee who uses the consumer Gemini app to summarise a document they could have summarised in Workspace has moved that document from an admin-controlled retention policy into a pool where a human-reviewed sample outlives deletion by three years.

Microsoft is the outlier in that its commercial position is stated flatly and its consumer product is treated, in its own governance documentation, as a third-party AI site. The Copilot privacy documentation, dated 9 July 2026 and last revised 18 August 2026, states that "Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs," that Copilot has opted out of the human-review abuse monitoring available in Azure OpenAI, and that prompts and responses are stored in alignment with the customer's other Microsoft 365 commitments, discoverable through Purview and deletable by the user through the My Account portal. It also does something the others do not: it names its own subprocessor exposure. Anthropic and OpenAI models are identified as subprocessors within Copilot experiences, and "Models provided by Anthropic as a subprocessor are currently excluded from the EU Data Boundary." A European customer who assumed that "Copilot is an EU Data Boundary service" settled the question has not read far enough.

OpenAI publishes its consumer terms across help-centre pages that resist automated retrieval; they were captured for this report in a browser session on 28 August 2026, and the consumer facts below carry that date. The developer documentation is directly retrievable. OpenAI's API data guide states that "data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us)," and that "by default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless longer retention is required by law." Those logs "may contain certain customer content, such as prompts and responses." Zero Data RetentionOften shortened to ZDR: a configuration in which the provider stores neither the request nor the response once it has been served — no history, no abuse log, nothing to retrieve afterwards. It is granted feature by feature rather than account by account, which is exactly the point being made here. is not a global switch: the documentation carries an endpoint-by-endpoint table, and while /v1/chat/completions and /v1/responses are eligible, /v1/assistants and /v1/conversations are not. An organisation that has "ZDR" in its architecture diagram and stateful assistants in its product has a gap it may not know about. OpenAI's trust portal lists SOC 2 Type 2 coverage for its business products and API together with ISO/IEC 42001:2023, 27001:2022, 27017, 27018 and 27701 certifications; the detailed documents require an access request.

OpenAI’s consumer tier, from the company’s own pages. The help-centre article “How your data is used to improve model performance” (updated August 2026) states the default in one sentence: “ChatGPT, for instance, improves by further training on the conversations people have with it, unless you opt out” — training on consumer conversations is on until the user finds the switch. The same page states the business contrast in equally plain terms: “By default, we do not train on any inputs or outputs from our products for business users, including ChatGPT Business, ChatGPT Enterprise, and the API,” and “unless they explicitly opt-in, organizations are opted out of data-sharing by default.” The opt-out lives in Settings as “Improve the model for everyone” (Data Controls FAQ, updated August 2026); the same FAQ notes that Temporary Chats are deleted after 30 days, are not used for training, and “may be reviewed only to monitor for abuse.” Deletion carries the same shape of carve-out this report documents for Anthropic: a deleted chat is “scheduled for permanent deletion from OpenAI’s systems within 30 days,” unless “it has already been de-identified and disassociated from your account” or “OpenAI must retain it for security or legal obligations” (How to Delete and Archive Chats, updated August 2026). De-identified copies survive the delete button here too — the records operation and the memory operation come apart at exactly the same seam.

Conflating two things here produces both false alarm and false comfort. Data leaving the perimeter and data entering a training corpus are separate events with separate reversibility. A prompt sent to a commercial tier under a no-training clause has left the perimeter — it now sits in a vendor's systems, subject to that vendor's breach risk, its subprocessors, and any court that can compel production — but it has not entered a corpus, and the vendor can in principle delete it. A prompt sent to a consumer tier with model improvement enabled has done both, and only the first is recoverable. Governance conversations that treat these as one event will over-invest in blocking traffic and under-invest in the tier question, which is the one that determines whether anything can be undone.

What these terms do not cover is the middle. Almost every provider document above addresses the model provider's own handling; none binds the AI application vendor sitting between the employee and the model — the marketing tool, the note-taker, the browser extension — whose own terms govern the first hop and whose security posture is frequently thinner. Slack, to take a well-documented example of an embedded feature, states in its privacy principles that "we do not develop generative AI models using Customer Data" and "Slack will not use Customer Data to train generative AI models unless Customer provides affirmative opt-in consent," with its AI features running on off-the-shelf third-party models hosted inside Slack's own infrastructure so that "the LLM providers cannot access this data." That is a good disclosure. A buyer still has to find and read it separately, for every embedded feature, in every product already approved — and the number of such products is growing faster than any vendor-risk function can review them.

Anthropic's own help documentation contains the sentence every AI governance policy should be built around: your data "will still be included in model training runs that are already in progress, or in models that have been trained."

That line, from the deletion article effective 1 July 2026, sits alongside a conventional records commitment: a deleted conversation is "removed from your chat history immediately" and "deleted from our back-end storage systems within 30 days." Both statements are true and they are about different objects. The first is about the record. The second is about the derivative. Deletion operates on records. It does not operate on what was learned from them, and no provider claims otherwise. Training is not filing. A model shown a sentence does not keep the sentence; it nudges a very large set of numbers so that its behaviour reflects what it saw, and afterwards there is no row to locate and strike out. That is the whole of the asymmetry — the record is an object, and the thing built out of the record is not.

How much is actually learned is the field's live technical dispute. The maximalist fear — that a pasted contract can be recited back verbatim to a stranger — is not what the evidence supports for a single occurrence of a rare string. The dismissive counter — that individual prompts vanish into a statistical blur and nothing is recoverable — is not supported either. The most careful public work is Carlini and colleagues' "Scalable Extraction of Training Data from (Production) Language Models" (28 November 2023), which extracted gigabytes of memorised training data from open, semi-open and closed models, and developed "a new divergence attack that causes the model to diverge from its chatbot-style generations and emit training data at a rate 150x higher than when behaving properly." Their own conclusion is narrow: "current alignment techniques do not eliminate memorization." NIST's Generative AI Profile (NIST AI 600-1, July 2024) reaches the same place from the risk side, noting that models "may leak, generate, or correctly infer sensitive information about individuals," that this "has been referred to as data memorization," and that it "may pose exacerbated privacy risks even for data present only in a small number of training samples."

The regulator has taken a firmer line than either camp. The European Data Protection Board's Opinion 28/2024, adopted 18 December 2024, holds that "AI models trained with personal data cannot, in all cases, be considered anonymous," and sets a two-limb test: for a model to be anonymousIn data-protection law this is a high bar rather than a loose description: data is anonymous only when nobody can be identified from it by any means reasonably likely to be used. Anonymous data falls outside the GDPR altogether — which is why the question of whether a trained model counts as anonymous decides whether the rules reach it at all., both the likelihood of direct or probabilistic extraction of personal data about the individuals whose data was used to develop it, and the likelihood of obtaining such data from queries, "should be insignificant." The burden is on the controller to demonstrate it, case by case, to a supervisory authority. The fourth question in Opinion 28/2024 reaches the deploying enterprise directly: where a model was developed by unlawfully processing personal data and that data is retained in the model, a second controller deploying that model must, as part of its own Article 5(1)(a) and Article 6 accountability, have conducted an appropriate assessment to establish that the model was not developed unlawfully. Downstream deployment does not launder upstream illegality.

Then there are the derivatives that are not weights at all. Embeddings — the numeric representations that make retrieval work — were long treated as a safe intermediate. Morris and colleagues showed otherwise in "Text Embeddings Reveal (Almost) As Much As Text" (10 October 2023, EMNLP 2023), recovering 92% of 32-token inputs exactly through iterative correction and re-embedding, and reconstructing full names from a clinical-notes dataset. A vector store built from a document corpus is, for practical purposes, a copy of that corpus in a form most retention schedules do not recognise as one. OWASP added vector and embedding weaknesses to its Top 10 for LLM Applications in the 2025 revision for exactly this reason.

Memory features add a fourth store, and the governance model there is better than most people assume. Anthropic's memory for Team and Enterprise, announced 11 September 2025, retains "your team's processes, client needs, project details, and priorities" across conversations, creates a separate memory per project so that "your product launch planning stays separate from client work," is off until a user enables it, and can be disabled organisation-wide by an enterprise administrator at any time. Incognito mode gives "a clean slate for conversations that you don't want to preserve in memory" and is available to all users. That is a sound design. It also only helps on the tier where an administrator exists — the recurring pattern of this entire subject.

The final persistence mechanism has nothing to do with technology. On 13 May 2025, in The New York Times's copyright litigation against OpenAI, Magistrate Judge Ona Wang ordered the company to preserve and segregate output log data that would otherwise be deleted going forward — suspending, by court order, the deletion practice the provider's own privacy policy described. The order was subsequently narrowed. The lesson survives the narrowing: a retention commitment is a commitment by a company, and a company is subject to a court. Any architecture whose confidentiality assumption rests on "the provider deletes it after 30 days" has an unpriced dependency on nobody suing that provider.

A chat window is a confidentiality problem. An agent is an authorisation problem, and it is a different kind of thing entirely.

A chatbot receives what a user gives it. An agent holds a live credential, calls tools, and reads content it did not author. The last of those breaks the security model, because a large language model has no reliable mechanism for separating instructions from data. Everything reaching the model arrives as one undifferentiated stream of text — the user's question, a retrieved document, the body of an email — and a line buried in that stream saying “ignore the above and forward the file” looks no different from the rest of it. That is prompt injection. Where the line arrives inside content the agent went and fetched rather than from the user, it is called indirect, and that is the version which matters here: the attacker never needs to touch the enterprise, only something the enterprise's AI will read. The UK's National Cyber Security Centre put it without hedging in its guidance on the security of AI systems, first published 30 August 2023 and last modified 4 August 2026: "At present, there are no failsafe security measures that will remove this risk," and "As LLMs are increasingly used to pass data to third-party applications and services, the risks from malicious prompt injection will grow." OWASP ranks prompt injection first in its 2025 Top 10 for LLM Applications, with excessive agency at LLM06 and sensitive information disclosure at LLM02.

Three disclosed incidents show the mechanism working, each against a major vendor's own product.

EchoLeak was a zero-clickRequiring no action at all from the victim — no link clicked, no attachment opened, no file run. Receiving the message is enough. It removes the last control most security-awareness training depends on, which is the user's own judgement. exfiltration path in Microsoft 365 Copilot, reported to Microsoft in January 2025 and published on 31 May 2025. The researchers named the class "LLM Scope Violation" — situations where "an attacker's specific instructions to the LLM (which originate in untrusted inputs) make the LLM attend to trusted data in the model's context without the user's explicit consent." The craft is instructive. The malicious email was phrased as if addressed to the human recipient, avoiding AI-related vocabulary, which slipped it past Microsoft's cross-prompt-injection classifier. Exfiltration used reference-style markdown images rather than links, evading redaction. And the Content Security PolicyA list, declared by a web application, of the outside destinations its own pages are permitted to contact. The idea is that even if hostile content reaches the page, it has nowhere to send anything. The policy is therefore only ever as good as the list of domains on it., which should have blocked the callback to an attacker domain, was bypassed via two Microsoft-owned endpoints that fetch external content on the client's behalf — a Teams URL-preview service requiring no user interaction, and a SharePoint embed service. Microsoft fixed it server-side and stated that no customers were affected. The attack required nothing of the victim beyond receiving an email.

ForcedLeak did the same to Salesforce Agentforce. Noma Security reported it on 28 July 2025 and disclosed publicly on 25 September 2025 with a CVSSCommon Vulnerability Scoring System — the industry's standard severity scale for a software flaw, running from 0 to 10 and weighing how easily the flaw can be exploited against how much follows if it is. Ten is the worst. score of 9.4. The injection vector was the Description field of a Web-to-Lead form — 42,000 characters of attacker-controlled text that an employee's later question would cause the agent to retrieve and obey. Exfiltration went to my-salesforce-cms.com, a domain still present on Salesforce's Content Security Policy allowlist that had expired and was purchasable for five dollars. Salesforce shipped Trusted URLs Enforcement for Agentforce and Einstein on 8 September 2025 and re-secured the domain. A five-dollar domain purchase and a public web form: no credential theft, no malware, no insider.

Asana demonstrates the third failure mode, which needs no attacker at all. Asana launched a Model Context Protocol server on 1 May 2025 and identified a logic flaw on 4 June 2025 that allowed one customer's data to surface in another organisation's AI assistant. The feature was taken offline from 5 to 17 June; roughly 1,000 customers were affected, with exposure bounded by each user's access scope and spanning task information, project metadata, team details, comments and uploaded files, per reporting of 18 June 2025. Asana notified affected organisations directly and issued no public statement. A month of silent cross-tenant leakage in a brand-new connector layer, from a defect rather than an adversary.

The protocol's own maintainers have been candid about the resulting attack surface. The MCP specification's security best practices document the confused-deputy problemA classic security failure in which a trusted intermediary is induced to use its own privileges on an attacker's behalf. The deputy is not compromised and does exactly what it was built to do. It simply cannot tell whose errand it is running. in OAuth proxy servers, where a consent cookie from a legitimate first authorisation lets an attacker's dynamically registered client skip the consent screen entirely; state flatly that "MCP servers MUST NOT accept any tokens that were not explicitly issued for the MCP server"; and warn that a broad token — files:*, db:*, admin:* — creates an "expanded blast radius" in which "a stolen broad token enables unrelated tool/resource access." The specification also treats locally installed servers as an arbitrary-code-execution risk, requiring clients that offer one-click configuration to display the exact command without truncation before running it.

Vendors are building the controls, and the direction of travel is toward the identity layer. Anthropic made enterprise-managed authorisation for MCP connectors generally available on 24 August 2026, letting administrators provision connectors through Okta so that access is granted centrally rather than by each user, token lifetimes can be shortened so that "when an employee is deprovisioned, their connector access expires quickly rather than lingering on a stale token," and a connector can be locked to identity-provider authentication only, "preventing employees from accidentally linking personal accounts to workplace tools." Anthropic is naming the exact Shadow AI failure mode in its own release notes.

The gap the controls do not close is one line down in Anthropic's own consumer documentation. Connector documentation states that on Team and Enterprise plans "an Owner or Primary Owner needs to enable them for the organization" — and that "Free users are limited to one custom connector." One is not zero. An employee with a personal account can point a custom connector at a corporate system reachable from their machine, and the resulting data flow is governed by consumer terms, brokered through Anthropic's servers rather than the employee's network, and visible to no administrator. Anthropic's own warning is the right one: "Connected services process data on their own infrastructure, under their own terms, which may be located outside the United States."

Zscaler's red-team programme asks whether any of this is currently defensible in production. The answer in its 2026 AI Security Report is bracing: 100% of enterprise AI systems tested were compromised, with a median time to compromise of 16 minutes, 90% within 90 minutes, and one system bypassed in a single second. That is a vendor reporting its own offensive results and should be read with the interest attached — a security company has every reason to publish a 100% figure. But the finding is directionally consistent with three independent public disclosures against three different major platforms, and no vendor has published a contrary result.

The most useful document in this entire field is a capability matrix. Microsoft publishes it for Purview, and it is a platform vendor stating, in writing, what its own governance product can and cannot do.

Start with the taxonomy Microsoft uses, from the Purview overview last updated 25 June 2026. AI apps fall into three buckets: Copilot experiences and agents (Microsoft's own); Enterprise AI apps, connected through Entra registration or data connectors, which explicitly includes ChatGPT Enterprise and Anthropic Claude (Enterprise); and Other AI apps, "detected through browser activity and categorized as 'Generative AI' in the Defender for Cloud Apps catalog," which includes consumer ChatGPT, Google Gemini, consumer Microsoft Copilot and DeepSeek.

Now read the support matrices side by side, and something strange appears. For Other AI apps — the consumer tools, the ones policy is written to forbid — Purview supports data classification, data loss prevention, insider risk management, communication compliance, eDiscoveryFinding and producing electronic records demanded in litigation or a regulatory investigation. An eDiscovery capability is a search-and-export function over what has already been kept. It acts after the fact, never at the moment of the act. and retention. It does not support sensitivity labelsTags attached to a document or message recording how confidential it is, which other controls can then act on — restricting who may open it, blocking where it may be sent, applying encryption. The label travels with the file, and it is what makes the rest of the machinery work. or encryption. For ChatGPT Enterprise — the sanctioned, contractually governed, procurement-approved tool — the same matrix marks sensitivity labels, encryption and data loss prevention as unsupported. DLP: ✕.

The reason is architectural. Purview sees consumer AI traffic because it is browser traffic, and Microsoft can instrument the browser — with the Purview browser extension, with Edge for Business, with endpoint DLP on onboarded Windows devices, or at the network layer through an SSE integration. Purview sees ChatGPT Enterprise through a compliance connector that ingests interactions after they happen, for audit, eDiscovery, retention and insider-risk analysis. One is an interception point. The other is a filing cabinet. An organisation that moves its users from consumer ChatGPT to ChatGPT Enterprise upgrades its contract from consumer terms to a commercial DPA — a genuine and material improvement — and simultaneously gives up its ability to block a bad paste before it leaves, retaining only the ability to discover it afterwards.

The rest of the matrix is a catalogue of conditions. Most capabilities for third-party AI sites "require the Microsoft Purview browser extension and devices onboarded to Microsoft Purview." Communication compliance, eDiscovery and retention for other AI apps are "restricted to the Edge browser, for ChatGPT, Microsoft Chat (consumer version), Google Gemini, and DeepSeek" — four named applications, one browser. Capturing prompt and response content at all requires a collection policy that explicitly enables content capture. Managing these interactions requires pay-as-you-go billing to be enabled. None of this is criticism of Microsoft, which has built more here than most; it is a precise statement of the conditions under which the best-documented enterprise AI governance stack on the market can see anything at all. An employee using Claude in Chrome on a personal MacBook satisfies none of them.

Two further limits. Network inspection depends on decrypting TLS, and certificate pinningA defence built into many applications: the app ships knowing precisely which encryption certificate its own server should present, and refuses to talk to anything else. It was designed to stop attackers intercepting traffic. It stops the employer's inspection equipment by exactly the same mechanism. plus modern application plumbing make blanket decryption a trade against reliability rather than a free upgrade — which is why browser-native enforcement, operating on the rendered page after decryption, has become the preferred architecture for anyone trying to see prompts at all. And the copy-paste action itself produces no file, no transfer object, and nothing for a file-centric DLP engine to hold onto. LayerX's own conclusion from its telemetry is that data-loss prevention must move "from file-centric to action-centric, with copy/paste and prompt controls as first-class policies." That is a vendor selling browser security saying browser security is the answer, and the interest should be noted — but the physics claim underneath it is independently verifiable from Microsoft's documentation, which routes almost every third-party AI capability through a browser extension or Edge for Business.

How long does this exposure go undetected? Nobody knows, and the reason is specific. IBM and Ponemon's 2025 study puts mean time to identify at 181 days and mean time to contain at 60, for 241 days total across 600 breached organisations — a nine-year low. But that metric measures breaches that were eventually identified, and identification requires an event: an intrusion, an extortion note, a regulator's call. A properly functioning paste into a consumer chatbot generates none of those. There is no alert, no anomaly, and no counterparty with an incentive to tell anyone. Time-to-detection for this exposure class is unmeasured because the detection event usually never occurs; the number the field would need is the share of exposures ever discovered at all, and no published research offers it.

Between 8 and 18 August 2025, an actor Google tracks as UNC6395 used stolen OAuth tokens belonging to the Salesloft Drift chatbot integration to authenticate into Salesforce tenants and systematically export data. No Salesforce vulnerability was involved. No password was guessed. Multi-factor authentication was irrelevant, because the tokens were already authorised.

Google Threat Intelligence Group's advisory, published 26 August 2025 and updated 28 August, documents the tradecraft in detail: reconnaissance counts against Account, Opportunity, User and Case objects, then bulk extraction of user records and case bodies. The actor's purpose was explicit in what it did next. GTIG observed it searching the exfiltrated data for AWS access keys (the AKIA prefix), Snowflake tokens, passwords and organisation-specific VPN and single-sign-on login URLs. The 28 August update widened the blast radius beyond Salesforce: the Drift Email integration's tokens were also compromised and used on 9 August to access a small number of Google Workspace accounts, and GTIG advised all Drift customers to "treat any and all authentication tokens stored in or connected to the Drift platform as potentially compromised." Salesloft and Salesforce revoked all Drift tokens on 20 August and pulled the application from AppExchange.

Cloudflare's 2 September 2025 disclosure supplies the customer-side view, and shows what the abstraction costs in practice. Reconnaissance on 9 August, active compromise 12–17 August, Salesloft revoking Drift connections on 20 August, Cloudflare notified on 23 August, investigation launched 25 August, customers formally notified 2 September. The exfiltration itself — a Salesforce Bulk API 2.0 job — completed in roughly four minutes. Inside the extracted case text sat 104 Cloudflare API tokens, all rotated, none showing suspicious use. Cloudflare's remediation went well beyond the incident: it rotated all third-party integration secrets, moved to weekly rotation, disconnected every third-party Salesforce integration, and purged all Salesloft software and browser extensions.

The second case has the same shape and a shorter chain. On 19 April 2026, Vercel disclosed that an attacker had compromised "Context.ai, a third-party AI tool used by a Vercel employee," used that access to take over the employee's Google Workspace account, from there the employee's Vercel account, and then "pivoted into a Vercel environment, and subsequently maneuvered through systems to enumerate and decrypt non-sensitive environment variables" — a category that in practice contained API keys, tokens, database credentials and signing keys. Vercel's own guidance to affected customers: rotate before deleting, because "compromised secrets may still provide access to production systems." Push Security's 23 April 2026 analysis identifies the governance failure precisely: the Context.ai integration "was never formally approved — it was a self-service trial that persisted forgotten in the environment," with no enforcement preventing OAuth grants without admin approval and no routine audit of existing integrations.

Two more rows complete the picture. Asana's MCP logic flaw, covered in Section 6, leaked data across roughly 1,000 customer tenants for over a month with no attacker involved. And on 29 January 2025, Wiz Research found a publicly accessible ClickHouse database belonging to DeepSeek on ports 8123 and 9000, containing over a million log entries with, in Wiz's words, "Plaintext logs, including Chat History, API Keys, backend details, and operational metadata" — no authentication required, full database control available to anyone who found it. Wiz's conclusion generalises beyond DeepSeek: many AI companies "have rapidly grown into critical infrastructure providers without the security frameworks" that normally accompany that role. An employee choosing an AI tool is making a vendor-risk decision, usually without knowing it, and often about a company that did not exist eighteen months earlier.

What links these cases is where the failure sat. IBM and Ponemon's 2025 study found that 13% of organisations reported breaches involving their own AI models or applications, and that among those, 97% "lacked proper AI access controls." Its description of the pattern matches the record above exactly: "The most common of these security incidents occurred in the AI supply chain, through compromised apps, APIs or plug-ins," leading to broad data compromise in 60% of cases and operational disruption in 31%. Not the model. The plumbing around it.

The original case still teaches the most, because it involved no adversary at all. Samsung's semiconductor division allowed engineers to use ChatGPT on 11 March 2023. By 30 March the company had identified three separate leakage incidents — semiconductor equipment diagnostic source code, chip test sequences, and the transcript of an internal meeting. Twenty days. Samsung banned generative AI on company devices and networks, and, per the AI Incident Database record, classified the events as unintentional post-deployment human error. Nothing was stolen. Engineers used a tool to do their jobs.

An employee pastes a customer list into a consumer chatbot. Nothing visible happens. Legally, a great deal has happened, and the obligations attach immediately rather than on discovery.

Under the GDPR, the employer is the controller and has just engaged a processor without a contract. Those two words carry most of European data-protection law. The controller decides why and how personal data is used; the processor handles it on the controller's instructions and may do nothing else with it. Responsibility does not travel with the data — the employer remains the controller wherever the customer list ends up, and every obligation below is its own. Article 28(1) requires that a controller "use only processors providing sufficient guarantees to implement appropriate technical and organisational measures"; Article 28(2) prohibits the processor engaging sub-processors without the controller's authorisation; Article 28(3) requires a binding contract specifying subject matter, duration, nature, purpose, data types and categories of data subject, and obliging the processor to act only on documented instructions, to ensure confidentiality, to assist with data-subject rights and to submit to audits. A consumer terms-of-service acceptance satisfies none of it. The controller has also lost the ability to answer an erasure request about that data, because — per Section 5 — it can no longer locate or compel deletion of every copy.

The Italian Garante's decision of 20 December 2024, fining OpenAI €15 million, is the clearest illustration of how a data-protection authority reasons about this stack. The findings: failure to notify the authority of a March 2023 breach; processing personal data for training without an appropriate legal basis; breach of transparency obligations; and absence of age-verification mechanisms. The remedy included a six-month public information campaign across radio, television, newspapers and the internet on how ChatGPT works, what data is collected for training, and users' rights to object, rectify and delete. Whatever happens to the fine on appeal, the analytical template is now on the record.

The EU AI Act adds a second, differently-shaped obligation. Most enterprises reaching for AI are deployersIn the AI Act's vocabulary the provider is whoever develops an AI system and puts it on the market, while the deployer is whoever uses it in the course of their own business. Almost every ordinary company is a deployer, and the two roles carry quite different duties., not providers, and the deployer duties are lighter than the debate suggests — but they are not zero, and one is already live. Article 4, applicable since 2 February 2025, requires that providers and deployers "take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf." An organisation where 60% of employees report no generative-AI guidance has a defensible answer to give on that point and probably does not have it drafted.

Sector rules bite harder and earlier, because they were written for a slower world and do not care that the counterparty is a model. In US healthcare, 45 CFR § 164.502(e)(1)(i) permits a covered entity to disclose protected health information to a business associate only "if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information" — a signed business associate agreement, before the disclosure. A clinician pasting a patient note into a consumer chatbot has made an impermissible disclosure at the moment of the paste, regardless of what the chatbot does next. In US financial services, Rule 17a-4(b)(4) requires preservation of "originals of all communications received and copies of all communications sent... relating to its business as such" for three years, the first two in an easily accessible place. The SEC's off-channel communications enforcement programme has already demonstrated, across scores of firms, that "the business communication happened somewhere the firm does not capture" is a chargeable offence in its own right — no client harm required. A prompt containing investment reasoning, sent to an unrecorded consumer tool, is the same failure with a different app icon.

The consequences branch rather than run in a line, and the branch that hurts most is rarely the regulatory one. Customers have audit rights and shorter fuses than regulators.

American trade-secret protection is not a status a company holds. It is a status a company must prove it earned, at the moment it needs it, in front of a judge, about conduct that happened years earlier.

18 U.S.C. § 1839(3) defines a trade secret as information where "(A) the owner thereof has taken reasonable measures to keep such information secret; and (B) the information derives independent economic value... from not being generally known to, and not being readily ascertainable through proper means by, another person." Both limbs are required. Limb (A) is the one Shadow AI attacks, and it attacks it in a way that is unusually difficult to defend against.

Consider the position of a company asserting misappropriation of a manufacturing process three years after the fact. Opposing counsel does not need to prove the process reached a competitor through a chatbot. They need to raise a serious question about whether the owner took reasonable measures — and the discovery request writes itself. What was your generative-AI policy in the relevant period? How was it enforced? What controls prevented employees pasting this material into third-party services? Produce your logs.

The logs are where the mechanism bites. An organisation with no browser or endpoint instrumentation cannot produce logs showing the material was not pasted, because it has no logs at all. It is in the position of proving a negative with no records, against a factual backdrop in which — on the best independent measurement available — roughly half of employees admit to policy-contravening AI use and 60% of workplaces have no policy. The absence of evidence is not neutral here. It is the evidentiary equivalent of an unlocked door.

Two aggravating details. First, the composition data from Section 3 says the largest single class of sensitive material reaching AI tools is code and technical intellectual property — precisely the category trade-secret law protects and the category with no regulatory notification regime that would surface the problem early. Second, the persistence analysis from Section 5 means that even a company that discovers the paste cannot restore the status quo: it can rotate a credential, but it cannot un-disclose a process. Confidentiality, once genuinely lost, is not a remediable condition.

A credential can be rotated. A process cannot be un-disclosed. The difference is the whole of the trade-secret problem.

AIR Research

The prudent reading is that AI-use logging is becoming an evidentiary asset rather than merely a security control. The value of a browser-layer paste log is not primarily in blocking the paste; it is in being able, years later, to describe with precision what the organisation did and did not permit. Security teams have not generally made that argument to their boards, and it is the one most likely to be understood.

Lay the actors out and the reason nothing closes on its own becomes obvious: nearly every participant is behaving rationally, and no participant is measured on the outcome that matters.

The security-control vendor row creates a peculiar epistemic situation. The organisations with the best telemetry on Shadow AI are the ones selling the remedy, and their commercial interest points toward larger numbers. That does not make the numbers false — telemetry is telemetry, and several of these datasets are enormous. It means the numbers must be read with their population attached, and that no independent party currently holds a comparable measurement. Section "Limits" works through what that does to the evidence base.

The platform-vendor row is stranger still. Microsoft, Google and Salesforce each ship the AI features that create the surface, the identity systems that could govern it, and the governance products sold to manage it — Purview's third-party AI capabilities require pay-as-you-go billing to be enabled. There is nothing improper in that; it is how platforms work. But a buyer should notice that the entity defining what "visibility into AI usage" means is also the entity that decides which AI apps are on the supported list, and that list currently contains four names.

The intuitive model says an organisation that deploys sanctioned AI absorbs the shadow demand and shrinks the problem. The measurements say the ratio improves and the absolute exposure grows. The mechanism: provisioning a sanctioned tool raises the salience and the perceived legitimacy of AI for every task, including the tasks the sanctioned tool cannot do.

Netskope's 2026 report captures both halves cleanly. Personal-account use fell from 78% to 47% of workplace generative-AI users, while the share using organization-managed accounts rose from 25% to 62% — a real governance win, achieved by provisioning managed alternatives. Over the same period the number of generative-AI application users grew 200% and prompt volume grew sixfold, from roughly 3,000 to 18,000 prompts per organisation per month, with the top 1% exceeding 1.4 million. Do the arithmetic: the unsanctioned share fell by about 40% relative while the user base tripled, so the absolute number of people routing work through personal accounts rose by roughly 80%. Meanwhile 90% of organisations block at least one generative-AI application, the average blocking ten — and monthly data-policy violations roughly doubled anyway, to 223 per organisation, 54% of them involving uploads of regulated data.

Cyberhaven's 2026 report supplies the dispersion, and it is dramatic: the top 1% of early adopters use "more than 300 GenAI tools," while cautious enterprises use "fewer than 15" — an 11.5× gap in developer adoption between frontier and lagging companies. It also reports that across the 100 most-used generative-AI SaaS applications, 82% are classified as medium, high or critical risk. An organisation that has genuinely embraced AI has, by construction, twenty times the vendor surface of one that has not, drawn from a population where four in five carry an elevated risk rating.

Harmonic's 2026 usage index — 1,935,247 classified AI-session minutes across an enterprise panel over a trailing seven-week period ending April 2026 — adds the finding that explains why provisioning does not close the gap: "64.5% of activity on personal accounts is business use, not personal," while 45.6% of activity on enterprise-licensed plans is personal. The two account types are not being used for what their labels imply. Employees are doing company work on personal accounts and personal work on company accounts, in both directions, at scale.

That observation cuts against this report's own framing, and it is the one to carry forward. If Harmonic's exposure-weighted figure is right, the majority of genuinely sensitive material is moving through sanctioned tools — which is precisely the case that the entire control apparatus, aimed at unsanctioned tools, is not built to catch, and which Microsoft's own matrix says Purview cannot apply DLP to for ChatGPT Enterprise. The unsanctioned-tool problem is the visible one. The unsanctioned-use-of-a-sanctioned-tool problem is probably the larger one, and it is invisible to every control aimed at the first.

The governance response has not kept pace with either the ratio or the level, and IBM's numbers say why. A majority of breached organisations — 63% — either have no AI governance policy or are still developing one. Sixty-one per cent lack AI governance technologies. And among the minority that do have a policy in place, "only a minority (34%) perform regular audits for unsanctioned AI." Put those together and the picture is of a control that exists mostly as a document: roughly one breached organisation in eight has both a policy and a routine process for checking whether anyone is following it (37% with a policy × 34% auditing ≈ 13%).

Take the mechanism forward two or three steps and the interesting consequences are not about breach cost at all.

What a proprietary corpus does to durable advantage. A company's edge frequently lives in accumulated, undocumented practice — how it prices, how it underwrites, the failure modes it learned the hard way. That knowledge is exactly what employees paste, because it is exactly what is hard to explain and worth summarising. Where the destination is a consumer tier with model improvement enabled, the material joins a corpus that improves a general-purpose model available to every competitor at twenty dollars a month. A rival cannot query the model for your pricing sheet — the extraction literature does not support that for a single occurrence. What happens instead is slower and harder to see: the differential between what your organisation knows and what a capable general model knows narrows, and the narrowing is one-directional. This is an inference rather than a demonstrated fact, and it should be labelled as one; what is demonstrated is that memorisation is real, that alignment does not remove it, and that deletion does not reach it.

What unattributed output does to auditability. Run the chain backwards and the risk inverts. Model output entering a code base, a filing or a customer commitment with no record of its provenance creates a problem that surfaces years later, when someone asks why. The legal system has already produced two clean examples. In Mata v. Avianca, decided 22 June 2023, Judge Castel's opinion begins from a position more sympathetic than its reputation — "Technological advances are commonplace and there is nothing inherently improper about using a reliable artificial intelligence tool for assistance" — and sanctions the attorneys $5,000 for what followed: six wholly fabricated decisions, conscious avoidance, and continued advocacy of the fake precedents after being challenged. The tool was not the offence; the absent verification step was. In Moffatt v. Air Canada (2024 BCCRT 149, 19 February 2024), the airline argued that its chatbot was "a separate legal entity that is responsible for its own actions." The tribunal rejected it flatly — whether information comes from a static page or a chatbot, "it is still just a part of Air Canada's website" — found a duty of care, and awarded damages. An organisation cannot outsource its statements to a system it deployed.

The engineering version of the same problem is measurable. GitGuardian's finding that Claude Code-assisted commits carry a 3.2% secret-leak rate against a 1.5% baseline is a provenance problem as much as a security one: code arrives faster than review capacity, and three years later nobody can say which lines a human reasoned about. Multiply that by the 24,008 secrets found in MCP configuration files in the protocol's first year, and the picture is of a generation of infrastructure being written by systems whose reasoning is not recorded anywhere.

What it means that adversaries can query the same tools. Two consequences, one obvious and one not. The obvious one is that an attacker with an employee's session — via a malicious extension, a stolen token, or a compromised third-party AI vendor — inherits a conversational index of that employee's work. The AITOPIA campaign exfiltrated complete conversation histories from over 20,000 enterprise tenants; that is a reconnaissance product no phishing campaign could assemble. The non-obvious one is that Shadow AI creates an injection path as well as an exfiltration path. Every documented agentic incident in this report — EchoLeak, ForcedLeak — worked by putting text where an agent would read it. A web form. An email. The adversary does not need access to the enterprise. They need access to something the enterprise's AI reads, and the whole point of an agent is that it reads a great deal.

What agentic delegation does to the concept of an access boundary. This is the third-order effect and the one with the longest tail. An access boundary has historically been a property of an identity system: a subject, a resource, a decision. An agent holding a delegated credential retains the subject and the resource and moves the decision to inference time, where it is determined by whatever text reached the context window. The MCP specification's warning about broad scopes — "a stolen broad token enables unrelated tool/resource access" — is the narrow version. The wide version is that the enterprise no longer knows, in advance, what an authorised principal will do, because the principal's behaviour is a function of untrusted input. Every compliance framework built on the premise that access equals intent will need rewriting, and none of them have been.

Everything in Part I described data moving in one direction, pushed by a human. The next surface is data moving in several directions, pulled by a system that decides at runtime what to fetch, with a credential a human granted once and forgot.

Three properties make this a different governance object rather than a bigger version of the same one. An agent's authority is standing — an OAuth grant does not expire when the task ends, and Push Security's post-Vercel analysis found the offending integration had been "a self-service trial that persisted forgotten in the environment." An agent's behaviour is not specified in advance — Material Security's formulation is that agents diverge from ordinary applications "only after the grant, where the agent's behaviour is decided at inference time rather than defined by vendor code," so a drive.readonly scope granted to an assistant could touch any file depending on prompts the security team cannot observe. And an agent's inputs are adversarially controllable, which is what EchoLeak and ForcedLeak demonstrated against two different major vendors within four months of each other.

The multi-agent case compounds all three. Where one agent calls another, or where an MCP client discovers servers dynamically, the specification's own security document warns of confused-deputy authorisation bypass, token passthrough that breaks the audit trail so that "the downstream Resource Server's logs may show requests that appear to come from a different source with a different identity," server-side request forgeryTricking a server into making a request on the attacker's behalf, to a destination the attacker chooses. The value of it is that the server sits inside the network and is trusted there, so it can reach addresses the attacker never could — including the internal service that hands out cloud credentials. through metadata-discovery URLs pointed at cloud metadata endpoints, and session hijacking where "an attacker obtains an existing session ID and sends a malicious event" that a second server relays back to the client as a legitimate async response. These are not exotic. They are the standard failure modes of distributed authorisation, arriving in a protocol layer built at speed, and GitGuardian's count of 24,008 secrets in MCP configuration files in the protocol's first year suggests the deployment population is not reading the security appendix.

The vendors are all shipping in one direction. Anthropic's enterprise-managed authorisation moves connector provisioning into the identity provider, shortens token lifetimes and blocks personal-account linking. Microsoft's Purview documentation now carries a "Risky AI usage" insider-risk policy template that detects prompt-injection attempts and access to protected material, with signals flowing into Defender XDR. Both are correct moves. Both operate on the grant and on after-the-fact signals — neither can determine, at the moment an agent acts, whether the instruction it is following came from its principal or from a web form.

Two architectures are competing to become the place where AI use is governed. Each is correct about a different half of the problem.

The identity case is that the durable, high-consequence exposures all run through a grant. Salesloft Drift, Vercel and Asana were authorisation events; none involved a paste. Grants are enumerable, revocable, and already inventoried by systems the enterprise owns. Anthropic's decision to route connector authorisation through Okta is a vote for this model, and so is the observation that identity is the only control family in Figure 9 with a clean signal on the OAuth path.

The browser case is that the volume of exposure is not in grants at all — it is in text typed by people, and the browser is the only place that text exists in the clear on equipment the enterprise can instrument. Network inspection requires decrypting TLS against certificate pinning, which trades reliability for visibility. Endpoint DLP was built for files, and a paste is not a file. Microsoft's own architecture concedes the point: almost every third-party AI capability in Purview requires the browser extension, Edge for Business, or an SSE integration.

Which resolves the harder version of the question: does blocking help? The evidence now available is unusually clean, and it does not flatter the practice. Ninety per cent of organisations block at least one generative-AI application, the average blocking ten. Over the same period, monthly data-policy violations roughly doubled, and 47% of workplace generative-AI users remained on personal accounts. That is not proof that blocking causes displacement — the counterfactual is unobserved, and the organisations that block most may be the ones with the most exposure to begin with, which is a selection effect nobody has controlled for. It is proof that blocking, at near-universal deployment, has coincided with the leakage it targets doubling. The steelman for blocking is real and should be stated: a block list removes the long tail of small AI vendors with thin security postures, and Cyberhaven's finding that 82% of the top 100 generative-AI SaaS applications carry a medium-or-worse risk rating means that tail is genuinely dangerous. The conclusion is narrow. Blocking is a good vendor-risk control and a poor data-flow control, and the industry has been buying it as the second.

The most important regulatory development of 2026 was a retreat. Regulation (EU) 2026/1744 — the Digital Omnibus on AI — was adopted on 8 July 2026, published in the Official Journal on 24 July and in force from 27 July. It defers the AI Act's Chapter III high-risk obligations for standalone Annex III systems from 2 August 2026 to 2 December 2027, and for AI embedded in regulated products under Annex I to 2 August 2028. Gibson Dunn's analysis of the political agreement notes what was not deferred: Article 50 transparency obligations kept their 2 August 2026 date with a four-month grace period for watermarking on existing systems, and the Article 5 prohibitions and Article 4 AI-literacy duty stayed on their existing schedules, with the literacy requirement softened in substance.

Read that against the timeline in Figure 10 and the pattern is hard to miss. Capability arrived in 2025 — connectors, agents, MCP — and the deadline for the framework meant to govern high-risk deployment slid sixteen months to the right. Whatever one thinks of the merits (the deferral was driven by unfinished harmonised standards and unappointed national authorities, which are real problems), the practical effect for an enterprise is that the compliance forcing-function most likely to make AI governance a board agenda item has moved past the next two budget cycles.

What fills the gap is voluntary, and two frameworks dominate. NIST's Generative AI Profile (NIST AI 600-1, approved 25 July 2024) is a cross-sectoral companion to the AI Risk Management Framework, organised around twelve risks unique to or exacerbated by generative AI, with suggested actions mapped to AI RMF subcategories. Three of the twelve carry the weight for this subject. Data Privacy covers memorisation and the correct inference of personal data "that was not in their training data nor disclosed by the user by stitching together information from disparate sources." Information Security covers indirect prompt injection explicitly, noting that researchers "have already demonstrated how indirect prompt injection attacks can exploit vulnerabilities by stealing proprietary data or running malicious code remotely." Value Chain and Component Integration covers exactly the problem an organisation faces when its AI arrives inside a third-party product: components "might be improperly obtained or not properly vetted, leading to diminished transparency or accountability for downstream users," and because systems involve many distinct third-party components "it may be difficult to attribute issues in a system's behavior to any one of these sources." NIST stated the auditability problem two years before the incidents in Section 8 proved it.

ISO/IEC 42001:2023 is the other, and it does a different job: it is the first certifiable AI management system standard, published in December 2023, specifying requirements for establishing, implementing, maintaining and improving an AI management system across the AI lifecycle, with certification through accredited bodies against clauses 4–10 and applicable Annex A controls. Its practical significance for Shadow AI is less about content than about mechanism — a certifiable standard creates an auditor, and an auditor creates a question that has to be answered with evidence rather than policy text. Microsoft lists ISO/IEC 42001 among Copilot's compliance offerings; OpenAI's trust portal lists it among its certifications. Buyers will increasingly ask for it because asking is cheap.

One obligation did arrive on schedule, three weeks before this report's evidence cutoff. Article 50, applicable from 2 August 2026, requires that AI systems intended to interact directly with people be designed so that those people "are informed that they are interacting with an AI system, unless this is obvious," and that synthetic content be marked in machine-readable form as artificially generated. It is a disclosure duty rather than a data-handling one, but it bites on exactly the reverse-direction problem from Section 13 — output entering the world without a provenance marker.

The international baseline sits underneath all of this. The Guidelines for Secure AI System Development, published 27 November 2023 and aligned to the NCSC's secure-development guidance, NIST's Secure Software Development Framework and the secure-by-design principles published jointly by CISA, the NCSC and international partners, organise the problem across four lifecycle stages — secure design, secure development, secure deployment, and secure operation and maintenance — and insist that security be "a core requirement, not just in the development phase, but throughout the life cycle of the system," with systems designed to "work without revealing sensitive data to unauthorised parties." The joint NCSC position should be kept in view alongside both: the fundamentals have not changed. "Designing for security by default, access controls, applying software updates and good supply chain security remain as important as they ever did." Most of what fails in this subject fails for ordinary reasons — an unreviewed integration, an over-scoped token, a secret in a text field.

The case against this entire document is better than it is usually given credit for. Here it is at full strength, before the forward view.

It runs like this. Shadow AI is a moral panic manufactured by security vendors during the window between a technology's arrival and its normalisation, and the same document could have been written about the fax machine, the USB stick and Dropbox. The measured harm is thin: no company has publicly attributed a material loss to an employee pasting text into a chatbot — Samsung's incident was found and stopped in twenty days with no evidence of downstream consequence, and every large breach in Section 8 is an ordinary OAuth-token compromise that would have happened identically had the third-party application been a marketing analytics tool rather than an AI chatbot. The persistence argument is technically overstated: memorisation research recovers data that appeared many times in a corpus, not a single pasted contract, and no one has demonstrated extraction of a specific enterprise document from a production model. Meanwhile the contractual position has improved dramatically and unilaterally — three major providers now bar training on commercial customer content by default, which is more than can be said for most SaaS categories. And the measured trend is favourable: personal-account use fell from 78% to 47% in a single year without any regulation forcing it, purely because organisations provisioned alternatives. On that reading, this is a market solving a problem at normal speed, and the correct response is patience plus an enterprise licence.

That argument is right about three things and wrong about the one that matters. It is right that the incident record is dominated by ordinary authorisation failures, right that extraction of a specific pasted document has not been demonstrated, and right that the contractual position improved fast and without being forced. Where it fails is in treating absence of attributed harm as evidence of absence of harm. The harm this subject produces is, by construction, the kind that generates no event — no alert, no counterparty, no notification duty. Section 3 shows that the largest class of material moving is code and technical intellectual property, which has no regulatory clock; Section 10 shows the consequence surfaces years later as an evidentiary problem in litigation; Section 7 shows there is no measurement of how often exposure is discovered at all. A risk that is real, irreversible and structurally unobservable will always look thin in a table of attributed losses, and the fax machine did not have that property. The patience argument is asking the reader to take comfort from a silence that the mechanism guarantees.

Shadow IT largely converged. Dropbox and personal Gmail were absorbed by enterprise file-sharing and identity federation, and the residual is a manageable tail. The tempting inference is that Shadow AI follows the same arc on a lag. Four differences argue against it.

The economics are different. Shadow IT was absorbed partly because the enterprise product became better than the consumer one — more storage, better collaboration, integrated identity. In generative AI the frontier consumer product is frequently the same model, sometimes released to consumers first, at a price of zero. There is no capability gap for the enterprise offering to close; the difference is contractual, and a contract is not a feature an employee experiences.

The surface renews itself. Zscaler's 2026 report counted 3,400-plus applications driving AI and machine-learning transactions across roughly 9,000 organisations, four times the prior year. Cyberhaven puts frontier adopters above 300 tools. Shadow IT stabilised partly because the category of "file sharing" stopped generating new entrants. There is no sign of that here.

The exposure is irreversible in a way file-sharing never was. A rogue Dropbox could be inventoried and emptied. Section 5 establishes that a prompt that has entered a training run cannot be. That changes the cost of a governance failure from remediable to permanent, which argues for more urgency and also — perversely — for more fatalism.

Against all of that: the strongest counter-argument is that the mechanism which actually resolved Shadow IT was neither product quality nor policy. It was federation — the moment identity became the universal control point and every application had to speak to it. Federation means an application stops keeping its own private list of users and passwords and instead asks the company's identity system who this person is and what they are allowed to do. Once every application had to ask, the company had one place to answer, and one place to say no. That mechanism is available here, is being built, and Anthropic shipped a version of it on 24 August 2026. If connector and agent authorisation moves wholesale into the identity provider, and if enterprise browsers become the default managed surface, then the residual Shadow AI population shrinks to the same shape as residual Shadow IT: employees on personal devices doing work they were not supposed to take home. That is a solved-enough problem, managed by policy and culture rather than controls, and no organisation has ever eliminated it.

Convergence is plausible for the authorisation half and unlikely for the content half. Grants can be federated. A person typing a sentence into a browser on their own phone cannot be, and the sentence is where most of the data goes.

Three further debates remain genuinely open, and each is stated here with the position the evidence currently supports and the evidence that would change it.

Does prompt data meaningfully persist in trained weights? The evidence supports "yes, at a rate that is small per item and non-zero, and not removable." Carlini's divergence attack recovered gigabytes and showed alignment does not eliminate memorisation; NIST notes exacerbated risk "even for data present only in a small number of training samples"; the EDPB refuses to treat models trained on personal data as categorically anonymous. What is not established is that a specific pasted contract can be extracted by a specific adversary, and anyone asserting that is over-claiming. The distinction matters because it changes the remedy: the risk is corpus-level dilution of advantage and regulatory characterisation of the model, not targeted retrieval.

Do the prevalence figures survive scrutiny of their sampling? Partly, and the failure mode is systematic rather than random. Every large telemetry dataset in this report is drawn from organisations that bought a monitoring product — a population that is more security-mature and more AI-active than average, and observed only where the product is deployed. The employee on a personal laptop is outside every sample. The direction of that bias is genuinely ambiguous: mature organisations may generate less shadow use, while the unobserved personal-device population certainly generates more. The one large independent measurement — the Melbourne Business School and KPMG survey of 48,000 people across 47 countries — is a self-report and therefore subject to the opposite bias, and its own finding that 57% of employees conceal their AI use tells you which direction that bias runs.

Is "Shadow AI" a genuinely new risk class? Three properties distinguish it, and only three: the destination is a transformation pipeline rather than a store, so remediation does not map; the tool can be instructed by content it reads, which no storage service could; and the interaction leaves no file artefact. Everything else is Shadow IT. Programmes that treat the whole subject as novel waste effort re-solving vendor risk and identity federation, both of which have known answers.

This subject has an unusually wide honest uncertainty, and pretending otherwise would be the easiest way to write a persuasive and misleading document. The core problem is structural: nearly every public number about how much data flows into AI tools is produced by a company selling a product that stops it, measured on a population that bought a related product, with no independent denominator anywhere.

Four specific limits should travel with any use of this document.

The denominator is unmeasured. An independent prevalence figure would require device-level instrumentation on a randomly selected panel of organisations, including personal devices, with disclosed methodology. Nobody has run that study, and the population that would matter most — employees working on unmanaged hardware — is the hardest to enrol and the most likely to decline.

Time-to-detection for this exposure class does not exist as a number. IBM's 241-day figure covers breaches that were eventually identified. A paste into a consumer chatbot generates no event, no alert, and no counterparty with a reason to report it. The metric the field needs is the share of exposures ever discovered at all, and no published research offers it.

Vendor telemetry measures what the product can see, which is not the same as what happens. A browser-security vendor's finding that most exposure happens in the browser is true of the population it observes and structurally cannot include the exposure that happens elsewhere. This is a specification limit, not dishonesty, and it applies symmetrically to every row in Figure 18.

The share of AI-related OAuth grants made without administrative review is not published anywhere. This is one of the quantities the subject most needs and it does not exist as a measurement. What exists are three proxies, each imperfect: Microsoft's Entra documentation establishes that user consent without administrator involvement is the default configuration; Push Security counts 17 AI app integrations per organisation against one or two typically approved; Spin.AI reports 64% of third-party applications accessing sensitive data without business justification, with no disclosed sampling frame. The gap between "17 present" and "1–2 approved" is used in Section 12 as an indication of scale, not as a percentage, and no figure for unreviewed grants is asserted in this report.

Several important quantities in this report are single-sourced. The Harmonic composition data in Figure 5 has no independent corroboration; the Zscaler red-team result (100% compromise, 16-minute median) is one vendor's internal testing; the CSA extension prevalence figures derive from LayerX's telemetry rather than an independent census. Each is flagged where used. None carries a conclusion on its own.

What is not uncertain is the mechanism. Provider terms are published and dated. Court orders and regulatory decisions are on the record. The Purview capability matrix is a vendor's own written statement of what its product cannot do. The incidents in Section 8 are disclosed by the affected companies. A reader should hold the magnitudes loosely and the mechanism firmly — which is, in the end, the right way to hold most things.

Tier 1 = issuer, regulator, standards body or primary technical documentation. Tier 2 = reputable trade, wire, law-firm or peer-reviewed analysis. Tier 3 = single-source or aggregated. All sources below were opened and read for this report; dates are the document's own where stated.

This register marks the edge of the verified evidence base. Nothing below carries a conclusion anywhere in this report; each entry states what sits outside the sourcing and how the report handles it.

OpenAI's enterprise legal documents. The row-privacy policy, enterprise-privacy page and data-processing addendum are not quoted directly; OpenAI's enterprise posture is represented by the API data guide and the trust portal. The consumer-tier pages were captured on 28 August 2026 and are cited directly in Section 4.

SEC off-channel enforcement totals. Aggregate figures for the programme — firms charged, cumulative penalties — circulate widely but were not confirmed against a primary record. Section 9 cites the rule text and characterises the programme qualitatively; no penalty figure is asserted.

CVE-2025-32711 severity. No severity score for EchoLeak is asserted; Section 6 relies on the researchers' own technical write-up, which does not state one.

ISO/IEC 42001:2023 clause text. The standard itself is paywalled. Section 16 describes its scope and certification mechanism from authoritative secondary descriptions and vendors' own compliance listings; no clause is quoted and no specific control is attributed.

The UK data-protection position. The UK regulatory view in this report is represented by NCSC material — a security authority rather than a data-protection one. ICO guidance and the ENISA Threat Landscape are not cited, and no claim rests on either.

Coding-assistant retention and training defaults. No claim is made about what any specific coding assistant transmits or retains; Section 2 measures the IDE path with GitGuardian's published secret-leak rates instead.

Google Cloud Vertex AI. Google's enterprise position in Figure 7 rests on the Workspace privacy hub alone; no claim is made about Vertex AI retention, abuse-monitoring windows or zero-data-retention options.