DNS filtering for shadow AI: stopping data leaks and command links

At a glance

What this is: CyberFOX says shadow AI creates exposure paths through unsanctioned AI services, accidental data sharing, and malware command links, and that DNS filtering can block the outbound connections that make those risks possible.

Why it matters: This matters because IAM, PAM, and security teams need governance over who and what is allowed to reach external AI services, not just control inside the enterprise boundary.

Context

Shadow AI is the use of AI tools or services that bypass formal approval, inventory, or monitoring. The governance problem is not only the model itself, but the outbound connections it makes, the data employees submit to it, and the services it can reach without oversight.

For identity and access programmes, this creates a boundary problem. Traditional access controls often focus on internal systems and named users, while shadow AI introduces unmanaged services, unmanaged data flows, and weak accountability for what is sent outside the organisation.

Key questions

Q: How should organisations govern shadow AI without blocking legitimate use?

A: Start with approved-use policy, tool inventory, and data classification. Then require that any AI system handling internal information has named owners, logged access, and defined credential paths. The goal is not prohibition, but visibility and control. If a tool cannot be inventoried or monitored, it should not process sensitive data.

Q: Why does shadow AI increase enterprise risk even when users are authenticated?

A: Authentication only proves who the user is. It does not control what data that user can move into an AI tool or whether the tool is sanctioned. Shadow AI raises risk because the enterprise loses visibility into data flows, so a legitimate user can still create an uncontrolled disclosure path.

Q: What are the signs that AI tool usage is outside governance?

A: Look for repeated calls to AI endpoints from unmanaged devices, local processes tied to MCP servers, newly active OAuth tokens, and browser or desktop extensions that have not been reviewed. Those signals show the tool is not just installed, but actively moving data through a path security teams may not know exists.

Q: How can security teams decide whether DNS filtering is enough for AI governance?

A: DNS filtering is enough only as an enforcement and visibility layer, not as a complete governance model. It can block unauthorized destinations and surface hidden AI usage, but it cannot replace inventory, data classification, or lifecycle control for secrets and delegated access. Teams should use it to contain risk while they build policy and ownership around AI integrations.

Technical breakdown

Shadow AI creates an outbound trust problem

Shadow AI is risky because the control failure often happens after the user has already interacted with the tool. The issue is not just authorisation inside the enterprise, but whether the AI service can reach approved destinations and whether the organisation can see those connections. DNS filtering works at the name resolution layer, which makes it useful for blocking access to unknown or suspicious services before a session is established. That matters when employees discover tools faster than security teams can inventory them.

Practical implication: monitor and restrict outbound AI destinations, not just user logins.

DNS filtering complements, but does not replace, AI governance

DNS filtering is a network control, not a governance model. It can reduce exposure by preventing access to unauthorized services, but it does not classify data, decide which use cases are acceptable, or determine who is accountable for approved AI usage. Organisations still need sanctioned-tool inventory, usage policy, monitoring, and escalation paths. In identity terms, the control plane has to include both access decisions and service-level destination control, otherwise users can still move sensitive material into approved but poorly governed tools.

Practical implication: pair DNS enforcement with an approved AI inventory and clear data-handling rules.

AI-assisted malware changes the value of connection-layer controls

The article's third risk is malware that uses AI-enabled command-and-control channels. In that scenario, the malware still needs to resolve or reach external infrastructure for instructions, updates, or data exchange. DNS filtering can interrupt that channel even when the payload is adaptive or signature-based detection is weak. This is a useful reminder that some defensive value comes from denying reachability, not just detecting malicious code. For defenders, the question is which outbound paths should exist at all.

Practical implication: treat outbound DNS policy as a containment control for malware, not only a browsing filter.

Threat narrative

Attacker objective: The objective is to extract sensitive information or maintain a reliable external command path that bypasses internal security oversight.

1. Entry occurs when employees adopt unsanctioned AI services or malware embeds AI-assisted communication paths without security approval.
2. Credential or data exposure follows when users paste confidential material into external tools or when malicious services receive information from internal systems.
3. Escalation and persistence occur when the AI service or malware continues making outbound connections to unknown servers without governance or detection.
4. Impact is data leakage, loss of control over sensitive information, or a command-and-control channel that remains reachable from the environment.

Breaches seen in the wild

• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
• Hugging Face Spaces breach 2024: Unauthorised access to Hugging Face Spaces may have exposed secrets users stored for AI apps; tokens were revoked and org tokens removed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Shadow AI is a governance problem before it is a model problem. The article correctly focuses on uncontrolled AI services as a new outbound risk surface, not just as an internal adoption issue. Organisations can have strong user authentication and still fail if the tool itself can reach unapproved destinations or accept sensitive data without oversight. The practitioner conclusion is to govern service reachability as part of identity and access control.

DNS filtering is an enforcement layer, not a complete control framework. Blocking suspicious destinations can reduce leakage and command-and-control exposure, but it does not replace policy, inventory, or classification. That means security teams should treat DNS as one control in a wider AI governance stack, especially where users can adopt tools faster than procurement and review processes can track them. The practitioner conclusion is to align network enforcement with approved-use governance.

AI-assisted malware makes outbound control more important than signature confidence. Traditional detection assumes the malicious payload is the primary issue, but AI-enabled malware can change form while still depending on external instructions. That shifts the control conversation toward reducing reachability to unknown infrastructure. The practitioner conclusion is to treat destination control as part of resilience, not only content inspection.

Shadow AI exposes the approved-tool illusion. Many organisations assume that if a tool is popular or commercially available, it is implicitly safe to use. In practice, unmanaged AI services create a visibility gap that mirrors other identity and access failures: what is not inventoried cannot be governed. The practitioner conclusion is to extend governance from identity of the user to identity of the service.

DNS-level control belongs in the same conversation as NHI governance. AI services, automation agents, and malware all rely on machine-to-machine reachability. That makes outbound destination control relevant to broader NHI and service account governance, because unmanaged machine interactions are often where policy breaks first. The practitioner conclusion is to fold AI service egress into NHI oversight and zero trust boundary decisions.

What this signals

Shadow AI governance fails when the organisation treats user authentication as the end of the control story. The more useful control question is which services the environment can actually reach and whether those services are on an approved list. DNS filtering gives security teams a practical way to enforce that boundary without pretending it solves policy by itself.

Outbound destination control is becoming a core part of identity governance. AI services, bots, and other machine-mediated workflows behave like access paths as much as applications, which means they need inventory, policy, and egress enforcement. When those elements are missing, the organisation is effectively allowing unsanctioned machine interactions to self-provision.

Shadow AI expands the same visibility gap that NHI programmes already struggle with. If the organisation cannot see which AI services users are calling, it cannot govern the data those services receive or the external systems they contact. That makes AI egress management a practical extension of NHI and workload identity oversight.

For practitioners

• Build an approved AI service inventory List sanctioned AI tools, map the business use cases they support, and block everything else at the DNS layer so shadow adoption is visible and enforceable.
• Restrict outbound destinations for sensitive workflows Apply DNS policy to prevent tools used for code, finance, legal, and product work from reaching unapproved external servers or high-risk destinations.
• Define data handling rules for AI use Specify which classes of information can never be entered into external AI tools, then align policy enforcement with user guidance and monitoring.
• Monitor for unusual AI connection patterns Alert on tools that suddenly contact new domains, expand data volume, or shift to unfamiliar infrastructure because those changes can indicate abuse or compromise.
• Treat DNS as part of malware containment Use egress controls to cut off command-and-control paths that depend on name resolution, especially where malware may adapt faster than signature-based detection.

Key takeaways

• Shadow AI creates a governance gap at the boundary between user intent and external service reachability, so organisations need controls that see and shape outbound connections.
• DNS filtering is useful because it can block unauthorized AI destinations and reduce command-and-control exposure, but it only works when paired with inventory and policy.
• The most durable defence is an approved AI model that combines sanctioned tools, restricted data handling, and monitoring for unusual connection patterns.

Key terms

• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• DNS Filtering: DNS filtering is a control that blocks, allows, redirects, or reroutes traffic based on domain resolution requests. It reduces exposure to phishing, malware, and unwanted destinations by applying policy at the point where devices attempt to resolve names into reachable internet endpoints.
• Command-and-control: Command-and-control is the communication channel an attacker uses to issue instructions to malware and receive results back from a compromised host. For XWorm, the channel is encrypted and used for session management, payload delivery, surveillance, and modular expansion of capabilities after compromise.
• AI Tool Inventory: A complete record of the AI tools used across an organisation, including where they are connected, what data they can reach, and who approved them. It is the foundation for governance because security teams cannot control, monitor, or remove what they have not identified.

Deepen your knowledge

Our NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management in the context of modern identity security. It helps practitioners connect access control, service inventory, and governance decisions across human and non-human systems.