Shadow AI at Work Can Expose Company Data

Summary

Using unapproved AI tools at work can expose confidential data and create security and compliance risks. The article explains shadow AI and recommends approved tools, clear data rules, and IT review for connected agents and plug-ins.

Key points

• Shadow AI is AI use outside an organization's approved systems and processes; examples include chatbots, browser extensions, meeting bots, and app features.
• Data entered into public AI services may leave company control and could be retained or used to improve models, depending on privacy controls.
• AI assistants and agents may have vulnerabilities that attackers could exploit to reach the data and services available to them.
• The article cites a 2025 Microsoft study in which 71% of surveyed UK employees said they had used AI tools at work that their employer had not approved.
• It cites IBM research reporting that one in five organizations had a breach linked to shadow AI; 37% had policies to manage AI or detect shadow AI.
• Recommended safeguards include using approved work accounts and tools, checking data restrictions and privacy settings, registering use cases, and getting IT review before connecting agents or plug-ins.
• The article advises employers to provide useful approved options and clear rules rather than relying on outright bans.