AI Security
What Is Shadow AI?
- Unapproved tools
- Personal accounts
- Visibility
Short answer
Shadow AI is the use of AI tools, models or agents at work without the knowledge or approval of IT and security teams. Typical examples are an employee pasting customer data into a personal ChatGPT account, a browser extension with AI features, or a developer wiring an AI API into a script with a personal key.
What does shadow AI look like day to day?
It rarely looks like a security incident. It looks like people getting work done:
- A recruiter pastes six CVs into a personal Claude account to compare candidates.
- A finance analyst uploads a spreadsheet of supplier IBANs to an AI tool to reformat it.
- A developer adds a free-tier API key to a script that summarizes support tickets every night.
- A manager installs a browser extension that rewrites emails, which sends the text of every draft to its own servers.
- An engineer connects a coding agent to an MCP server found on GitHub.
Each of these moves personal data or company secrets to a provider your organization has no contract with, under terms nobody reviewed. It's the AI version of shadow IT, with one difference: the unit of transfer is a paste, not a file, so it's even harder to see.
Why does shadow AI happen?
- The approved tool is missing or worse. If the sanctioned assistant is slow or limited, people use the one at home.
- A ban without an alternative. Blocking chatgpt.com on the network moves usage to phones.
- Free tiers. No purchase order means no procurement review.
- AI features appear inside tools people already use, often switched on by default.
What are the risks of shadow AI?
| Risk | Example | Why it matters |
|---|---|---|
| Personal data disclosure | Customer records pasted into a consumer chatbot | Processing without a contract or legal basis under GDPR |
| Secret leakage | A log with a live API key pasted for debugging | Credentials outside your control need rotating |
| Unknown retention | Consumer plans with training or retention settings left on | You can't answer where the data is or delete it |
| Regulated data | Patient notes summarized in a free tool | Possible HIPAA issue without a business associate agreement |
| No evidence | No record of what was sent | You can't scope an incident or answer an auditor |
| Unvetted agents | An MCP server with broad access to internal systems | Tool calls can move data you never meant to share |
Why does banning AI tools rarely work?
Because the value is real and the ban is easy to get around. A blocked domain at the office isn't blocked on a phone hotspot. The result of a strict ban is usually the same AI use with less visibility. Bans make sense for specific tools with unacceptable terms. As a general policy, they trade a visible risk for an invisible one.
What should a shadow AI policy say?
Keep it to one page that people will actually read. It should name the approved tools and the accounts to use with them (company, not personal). It should say plainly what must never go into any AI tool, with examples from your own work: customer IBANs, patient names, unreleased financials, API keys. It should explain how to ask for a new tool and how long an answer takes; if the answer is "three months", people won't ask. And it should say what happens after a mistake. A policy that punishes honest reporting guarantees you'll never hear about incidents, which is the worst outcome of all.
How do you manage shadow AI?
- Find out what's in use. Ask teams, check expense reports, look at DNS and proxy logs for AI domains.
- Publish an approved list with a clear reason for each tool that isn't on it.
- Give people a safe path to the tools they want, with personal data and secrets masked before anything leaves the device.
- Cover the tools you can't approve yet with the same masking, so mistakes don't become disclosures.
- Train with real examples from your own business, not generic slides.
- Review quarterly. New tools appear every month.
Step 3 is where Maskflare fits. The desktop agent masks text sent to ChatGPT, Claude, Gemini, DeepSeek and Perplexity on the web, plus apps calling provider APIs that follow the system proxy, and only AI hosts are routed through Maskflare. Values are restored where the answer repeats them, so people get useful answers. Notifications such as "3 items masked in ChatGPT" show people the control is working without blocking them. You deploy it through Intune, Jamf or Group Policy. Browser protection covers the same sites in the browser and blocks credential-shaped values outright.
What can't you see?
Personal devices you don't manage. Mobile apps. AI features inside SaaS products that call models from the vendor's side. Maskflare covers ChatGPT, Claude, Gemini, DeepSeek, Perplexity, Mistral Le Chat and Microsoft 365 Copilot on the web, native AI desktop apps and clipboard pastes into AI apps. Its AI app discovery shows which AI apps your people use, with users, devices and upload volume, as metadata only: no prompts, no URLs and no general browsing history. See how it fits together in shadow AI.
Frequently asked questions
Is shadow AI the same as shadow IT?
It's a subset. Shadow IT is any unapproved technology. Shadow AI is unapproved AI tools, models and agents, where the main risk is the text people paste in.
Is using ChatGPT at work shadow AI?
Only if your organization hasn't approved it, or if it's used with a personal account outside the approved setup.
Should we block ChatGPT?
Blocking tends to push usage to phones and personal accounts. Masking personal data in the tools people use usually reduces risk more than a ban.
Can Maskflare discover which AI tools employees use?
Yes. AI app discovery lists the AI apps used on managed devices, with users, devices, first seen and upload volume, and a risk score per app. You can mark each app approved, tolerated or blocked. It records metadata only, never prompt content or general browsing.
Does masking work for files people upload?
In the browser, text files (.txt, .csv, .md, .json) are masked; other uploads follow your file policy, and images can be allowed, blocked or scanned.