Shadow AI Risks at Work: The Hidden Data Leak

Shadow AI risks at work can start with a helpful employee, a deadline, and a chat box that gives useful answers. A task can expose company data even when the person completing it has no intention of leaking anything.

If you’ve ever pasted a work email, a spreadsheet, or a chunk of code into a personal ChatGPT or Gemini tab to “just clean this up,” you have probably done a version of it. Whether it counts as shadow AI depends on what your organisation allows and what was in the text, which is exactly the judgement this post is about. This isn’t a scolding. The tools genuinely help. But if you’re also the person who has to wonder whether any of this is even allowed (a founder, a developer, or the de facto security owner on your team), then shadow AI is your problem twice over: you’re both a user and the one holding the risk. Here’s how to think about it clearly, for yourself and the people you lead.

Defining shadow AI: personal accounts, company data

Shadow AI is the use of AI tools for work without the knowledge, approval, or oversight of whoever is responsible for security. It’s the AI cousin of “shadow IT,” the old problem of employees using unsanctioned apps and cloud accounts.

One example is a person using their personal AI account to handle company data. Unapproved AI features inside tools you do sanction count too, and the common thread is unapproved use rather than the account type. A marketer summarizing an internal strategy doc in their own ChatGPT. A developer debugging proprietary code in a free Claude tab. A manager dropping the quarter’s numbers into Gemini to draft a summary. In these examples, assume the use has not been approved.

The tool name alone does not establish approval. The risk is the combination: sensitive work data flowing into an account your organization does not administer. Visibility depends on your controls. In supported configurations, Microsoft Purview can capture prompts and responses from third-party AI sites, and DLP can warn or block sensitive sharing. Those capabilities require the relevant deployment and policies; they do not give your company automatic control over deletion of the AI provider’s copy.

What the research says about personal AI use at work

Microsoft’s 2024 Work Trend Index reported that 78% of AI users bring their own AI tools to work. That is a measure of bringing tools, not proof that each use was unauthorized. Separately, Netskope’s 2026 report, describing its observations from 2025, shows personal-account use declining while organization-managed use rises. These are different datasets, not a single continuous survey. These findings describe the vendors’ observed populations, not every workplace:

47% of generative-AI users in Netskope’s data use personal AI apps, while 62% use organization-managed accounts. The two overlap, so read this as how many people reach for a personal account, not as a share of total AI traffic (Netskope, 2026).
Data uploaded to generative-AI apps rose from 7.7 GB to 8.2 GB per month, quarter over quarter. Netskope does not attach a per-organisation denominator to that figure, so neither does this sentence. What it does give per organisation is smaller than people assume: about 15 generative-AI apps in use, up from 13. The 1,550+ number quoted elsewhere is Netskope’s own catalogue of services it tracks, not anyone’s install list (Netskope, 2025).
Cyberhaven’s 2025 report classified 34.8% of enterprise data shared with AI in its dataset as sensitive, compared with 10.7% two years earlier.

These findings justify checking how AI is used in your organization. They do not establish that every personal account is unapproved or that every transfer is a breach.

Four ordinary moments that can expose company data

In these examples, a data-handling decision is embedded in an ordinary work task. A few everyday examples:

The “just summarize this” moment. Someone pastes an unreleased contract into a personal AI account to get the gist before a meeting.
The debugging shortcut. An engineer drops a stack trace and a block of proprietary code into a free chatbot to find a bug faster.
The tidy-up. A staffer cleans up a customer list or a spreadsheet of names and emails by asking an AI to reformat it.
The catch-up email. A manager feeds meeting notes (including a few things that weren’t meant to leave the room) into a chatbot to write a recap.

In each example, the risk depends on the information, the account, and the applicable policy. Sending data to an unapproved service can put it outside the company’s intended controls. It does not, by itself, show that the information became public or was used for model training.

Counting the real cost of shadow AI risks at work

IBM’s 2025 Cost of a Data Breach report studied organizations that had experienced breaches. One in five reported a breach due to shadow AI. Separately, organizations with high levels of shadow AI had average breach costs USD 670,000 higher than those with low levels or none. This is a comparison between groups, not an amount to add to the overall average breach cost.

Shadow-AI incidents in that study involved compromised personal information in 65% of cases, compared with 53% overall. IBM also reported that 63% of breached organizations either lacked an AI governance policy or were still developing one.

These observations show an association between high shadow-AI use and higher breach costs. They do not establish that a particular paste causes that cost or that lack of monitoring alone explains the difference.

Ask three questions before you paste

A useful starting question is, “Which AI tool is the safe one?” The tool name alone does not answer whether a particular use is appropriate.

Before sharing, check three things together:

What data is this? Public and throwaway, internal, or genuinely confidential? The sensitivity of the input decides everything downstream.
What account am I using? A personal consumer account, or an approved company plan with a contract behind it? Check the specific product’s training, retention, access, and deletion terms. Paying for a personal subscription does not establish that your organization approved it for this data.
Whose rules apply? Does your organization have a policy for this, and does this action fit it?

Use these questions as a check before sharing, alongside approved tooling and technical controls. They do not by themselves prevent unauthorized use. The goal isn’t to ban AI. It’s to make the safe path the obvious one.

Make the safe path the obvious one

You don’t fix shadow AI with a single tool or a stern email. You fix it by making good choices easy, for yourself and your team. This pillar is the hub for a series that walks through the practical pieces:

Start with the account comparison: ChatGPT vs Gemini vs Claude: Which Keeps Your Work Data Private? breaks down what each free plan does with your data and how to opt out.
From there, the series covers opting out of AI training across all three, a one-page acceptable-use policy your team can adopt, a pre-upload checklist for company data, and how everyday data leakage happens.

If you only take one thing from this page, make it the three-question habit above. It’s the difference between AI as a productivity tool and AI as an invisible leak.

FAQ

Can my employer see what I type into ChatGPT?

Possibly. A personal account does not guarantee that a prompt is invisible on a managed device or browser. Microsoft Purview supports prompt and response collection for supported third-party AI sites when the required controls and content-capture policies are configured. Authorized reviewers can then inspect collected content. That is different from administering your personal account or controlling deletion of the provider’s copy. Check your workplace’s monitoring notice and actual setup.

Can I get fired for using AI at work?

It depends on your company’s policy. Feeding confidential data into unapproved personal AI accounts can breach data-handling or acceptable-use rules, which in serious cases leads to disciplinary action. The safe move is to check whether an AI policy exists and use an approved tool for anything sensitive.

Should companies ban AI tools to stop shadow AI?

My recommendation is to combine approved alternatives, clear data rules, and technical restrictions where needed. A written ban alone should not be treated as proof that use has stopped. Blocking can be appropriate for particular tools or data; check that the controls cover the browsers and workflows your team actually uses.

How can you tell if employees are using shadow AI?

Compare the approved-tool inventory with available browser, proxy, and DLP records, then confirm account types and permitted uses. A visit to an AI service is a lead to investigate, not proof of a policy violation. Ask staff about their workflows rather than treating polished writing as evidence. What you can observe depends on the tools deployed and how they are configured.

What’s the difference between shadow AI and shadow IT?

Shadow IT covers unapproved software and cloud services more broadly. Shadow AI is unapproved AI use, including AI features inside otherwise approved tools. Prompts, uploaded files, and connected data sources can all be involved; storage and training depend on the product and its settings.

Sources

Each figure is labeled with the year of the report it comes from, which is not always the current year. Figures are cited as reported; check the linked primary sources for methodology and updates.

Written by Grace

I test AI tools and agents in my own workflow, and write down what I find, including the settings that surprised me. About Grace and how posts are verified