Shadow AI and Copilot data exposure are outpacing governance

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Proofpoint's blog post: Financial services firms are using GenAI for productivity while shadow AI, misconfigured Copilot access, and third-party integrations are widening data exposure.

Why it matters: This matters because IAM, PAM, and data security teams now have to govern who and what can surface data into AI workflows, not just who can log in.

Context

GenAI is becoming a normal work layer, but that makes access governance harder, not easier. Once employees can query documents, summaries, and internal systems through AI tools, the security question shifts from simple user authentication to who can expose which data into a prompt, connector, or downstream app.

This article sits at the intersection of identity governance, data security, and AI adoption. The article's examples show that sanctioned AI can still leak information when permissions are too broad, while unsanctioned AI expands the shadow AI problem outside normal control boundaries. That combination is now typical in organisations trying to move fast without redesigning access controls.

Key questions

Q: What breaks when Copilot can reach data through over-broad permissions?

A: When Copilot inherits excessive access, it turns latent permission sprawl into immediate data exposure. Users can discover files they were never meant to find through normal navigation, which means the real control failure is the underlying access model rather than the AI layer itself. The fix is to tighten permissions before expanding AI search and retrieval.

Q: Why do sanctioned AI tools create risk even when employees use approved accounts?

A: Approved accounts do not solve the problem if the connected data sources are too open or the tool can route content into supplier environments. Risk comes from the combination of broad entitlements, connector trust, and prompt-time disclosure. Teams should govern data movement and retention, not just user login status.

Q: What are the signs that shadow AI is creating governance and compliance gaps?

A: Common signs include limited visibility into who is using AI tools, no reliable audit trail for prompts and outputs, unclear data residency, and inconsistent handling of sensitive information. If compliance, legal, and executive teams lack the same visibility as IT, the organisation already has a governance gap. Those conditions make it difficult to prove control or investigate misuse.

Q: Should organisations block GenAI or control the data it can see?

A: Controlling data is the stronger approach. Blanket blocking often fails when employees still need AI for daily work, while data-centric controls reduce exposure without stopping approved use cases. The practical test is whether the organisation can explain what data each AI workflow can reach and why.

Technical breakdown

How Copilot and GenAI expose data through over-broad permissions

Copilot-style assistants do not create new data by themselves. They surface existing data based on the permissions and search boundaries already present in systems such as Microsoft 365, SharePoint, and OneDrive. If those permissions are too broad or inconsistently applied, the AI layer becomes an accelerator for exposure, not a new control point. The technical failure is usually inherited access sprawl, where indexing, inheritance, and connector permissions allow prompts to retrieve material the user should not have reached through normal navigation.

Practical implication: treat AI assistants as visibility amplifiers and audit the underlying access model before enabling them widely.

Why third-party AI integrations enlarge the non-human identity problem

Once a tenant contains thousands of connected applications, the control problem is no longer only human access. Third-party apps, AI-enabled plugins, and service integrations act as non-human identities with delegated permission paths into corporate data. If those identities are not inventoried, scoped, and reviewed, they can move data into supplier environments for processing without a clear governance boundary. This is an NHI problem because the trust relationship lives in tokens, app consents, and service permissions rather than in a human user's session alone.

Practical implication: inventory AI-connected apps and govern them as NHIs with explicit ownership, scope, and review cycles.

Shadow AI is a data governance issue before it is a usage issue

Shadow AI emerges when employees use unapproved models, public LLMs, or consumer tools to speed up work. The risk is not just policy violation. It is uncontrolled disclosure of code, records, prompts, and business context outside the enterprise boundary. In practice, this creates a governance gap because the organisation loses visibility at the moment data is entered into the model, which is often earlier than any downstream exfiltration detection. Blocking alone rarely works if the business has already made AI part of everyday workflows.

Practical implication: combine usage visibility, data loss controls, and exception governance instead of relying on blanket AI bans.

Threat narrative

Attacker objective: Expose sensitive corporate data through AI workflows by exploiting over-broad permissions, shadow AI use, or delegated app access.

1. Entry begins when employees place confidential material into public LLMs or connect sanctioned AI tools to corporate repositories and collaboration systems.
2. Credentialed access and delegated permissions then let Copilot or third-party apps surface content that exceeds the user's intended business need.
3. The attacker objective, or accidental equivalent, is to expose sensitive research, source code, or HR data into places where it can be copied, retained, or processed outside governance.

Breaches seen in the wild

• Samsung ChatGPT leak 2023: Samsung staff pasted chip source code and meeting notes into ChatGPT weeks after it was allowed, leading Samsung to restrict generative AI tools.
• McKinsey AI platform breach: McKinsey AI platform hack exposed 46M chats and sensitive data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Prompt-time exposure is becoming the decisive governance boundary. Traditional access reviews were built around documents, folders, and sessions, but AI assistants collapse those layers into a single query surface. When a user can surface content through a prompt, the control that matters is whether the data can appear there at all. Practitioners need to treat prompt-time exposure as a governance state, not a side effect of productivity tooling.

Shadow AI is really unsanctioned data routing. The main risk is not that employees are using AI, but that they are moving sensitive information into systems whose retention, training, and sharing rules are outside enterprise control. That shifts the problem from awareness alone to data boundary enforcement. Organisations should frame this as a policy, telemetry, and DLP issue rather than a pure usage-ban question.

Non-human identity governance now extends to AI-connected apps and connectors. The thousands of integrations that sit behind collaboration and productivity platforms behave like delegated machine identities, with their own permission scope and lifecycle. If those identities are not owned and reviewed, they become a hidden data transfer layer. This is where IAM, PAM, and NHI governance converge for AI programmes.

Access misconfiguration is the enabling condition, not the root surprise. Copilot did not invent the exposure problem. It exposed how much sensitive material was already reachable through inherited permissions, weak SharePoint hygiene, and broad connector trust. The control failure is a governance assumption that searchability and accessibility are interchangeable. They are not, and that distinction now defines AI-era data security.

Governance debt is the right concept for AI adoption risk. Each new AI exception, connector, and sanctioned use case adds obligations for inventory, ownership, and review that many programmes do not yet track as a formal debt. That debt accumulates silently until the enterprise can no longer explain where sensitive data is flowing. Practitioners should measure AI adoption against governance capacity, not productivity alone.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Prompt-time governance is now the control plane that matters. AI adoption is forcing teams to move beyond static access reviews and into real-time decisions about what data can be surfaced into a prompt, connector, or supplier workflow. In a programme sense, that means AI enablement and access governance can no longer be separate workstreams.

AI-connected apps should be treated as governed NHIs. The connectors, plugins, and service integrations behind collaboration suites carry delegated access that can move data outside the enterprise boundary. That makes ownership, scope, and offboarding just as important for AI integrations as they are for service accounts.

AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026. The signal for practitioners is that AI programmes are not maturing in isolation. They are creating fresh credential and exposure paths that identity and data teams need to govern together.

For practitioners

• Map AI-assisted data exposure paths Trace where Copilot, public LLMs, and embedded AI tools can access files, chats, and repositories, then identify which permissions make those surfaces searchable or retrievable.
• Inventory AI-connected non-human identities Catalogue every third-party app, connector, and AI-enabled integration in Microsoft 365 and other collaboration platforms, with owner, scope, and offboarding responsibility.
• Enforce prompt-time data loss controls Use DLP and content redaction on prompts, outputs, and copied content so sensitive material is blocked or masked before it reaches external models or supplier environments.
• Review SharePoint and OneDrive inheritance Audit inherited permissions, open sharing links, and overexposed project spaces that can be surfaced by AI assistants even when users think the data is confined.
• Create exception governance for sanctioned AI use Define who can approve public AI access, what data classes are forbidden, and how risky usage is monitored when business teams need temporary exceptions.

Key takeaways

• GenAI is increasing productivity in financial services, but it is also widening the gap between how data is used and how data access is governed.
• Misconfigured permissions, shadow AI, and third-party integrations are the real exposure paths, not the AI tools in isolation.
• Practitioners need prompt-time controls, delegated access governance, and inventory of AI-connected apps if they want adoption without uncontrolled leakage.

Key terms

• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Prompt-time exposure: Prompt-time exposure is the point at which sensitive information becomes visible to an AI model, connector, or assistant during a user query. It matters because the control failure happens before traditional exfiltration detection, so governance has to focus on what can be surfaced, not only what leaves the network.
• Delegated non-human identity: A machine or agent identity that acts on behalf of a user or system and inherits access to connected tools. The control problem is not only authentication, but the scope, duration, and downstream reach of that delegation once the session is established.
• Permission Inheritance: The practice of allowing access on one object to flow into related objects through defined traversal rules. It reduces duplicate configuration, but it also creates hidden privilege paths that must be understood and reviewed. In complex systems, inheritance is often the real source of effective access.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and secrets management in the context of real operational control. It helps practitioners align identity security decisions with the AI and automation changes reshaping enterprise access.