TL;DR: More than 80% of studied organisations showed signs of shadow AI activity, according to XM Cyber research, while Microsoft reported 78% of AI users bring their own tools and IBM said one in five organisations has already suffered a shadow AI-linked breach. The governance gap is no longer visibility alone, but control over unmanaged AI use, credentials, and data flow.
At a glance
What this is: This is an analysis of Shadow AI as an enterprise governance problem, with the central finding that unmanaged AI use is widespread and can expose credentials and sensitive data outside normal controls.
Why it matters: It matters because IAM, PAM, and security teams now have to govern AI use that bypasses approved workflows, creates hidden credential exposure, and sits outside traditional monitoring.
Context
Shadow AI is the use of AI tools inside the organisation without IT or security approval, and it creates a governance gap because the interactions often occur through encrypted browser sessions or unmanaged devices. That makes the activity hard to see, hard to log, and easy to overlook in programmes built around sanctioned software and stable asset inventories.
The issue matters to identity and access teams because the article ties Shadow AI to data handling and credential exposure, including API keys and tokens stored in MCP configuration files. In other words, this is not just shadow usage, but unmanaged identity and secret handling wrapped inside everyday AI adoption.
Key questions
Q: What breaks when organisations cannot see shadow AI usage?
A: When shadow AI is invisible, security teams lose control over where data is sent, which assistants are connected, and whether those systems can retain or expose sensitive information. That undermines policy enforcement, auditability, and incident response. It also means the organisation may be granting machine-driven access without a defined identity lifecycle.
Q: Why does shadow AI increase cloud security risk so quickly?
A: Shadow AI increases risk because employees often connect external tools to sensitive data and permissions to get work done faster. That creates new API paths, token exposure points, and data movement routes outside the approved access model. In cloud environments, those connections can expand the attack surface long before security teams notice them.
Q: What are the signs that AI tool usage is outside governance?
A: Look for repeated calls to AI endpoints from unmanaged devices, local processes tied to MCP servers, newly active OAuth tokens, and browser or desktop extensions that have not been reviewed. Those signals show the tool is not just installed, but actively moving data through a path security teams may not know exists.
Q: How should security teams govern shadow AI without blocking productivity?
A: Use visibility-based controls instead of blanket bans. Identify which tools are in use, who is using them, and what data they can access, then apply targeted policies by role and data sensitivity. That approach preserves legitimate AI adoption while reducing exposure from unsanctioned tools and unreviewed data paths.
Technical breakdown
Why Shadow AI evades conventional monitoring
Shadow AI often runs through consumer-style web interfaces, encrypted browser sessions, or unmanaged endpoints, which means network DLP, CASB, and browser logging do not reliably see the interaction. Traditional control stacks assume sanctioned apps, predictable routes, and inspectable traffic. Shadow AI breaks that assumption by moving sensitive exchanges into channels that look like ordinary browsing or by shifting activity onto devices outside corporate management.
Practical implication: extend discovery to browser and endpoint telemetry instead of relying only on network inspection.
How MCP servers turn AI usage into a credential risk
Model Context Protocol connects AI systems to tools and data sources, but the article highlights a governance weakness when MCP configuration files store API keys and tokens. Once those files are exposed, synced, or reused across repositories, the AI workflow becomes a direct path for secrets exposure and lateral movement. The control issue is not the protocol itself, but the way credentials are embedded into loosely governed development workflows.
Practical implication: treat MCP credentials as managed secrets, not local configuration clutter.
Why unmanaged AI changes the identity model
Shadow AI is not just another software category, because users can introduce AI services without formal onboarding, approval, or lifecycle oversight. That creates a parallel identity layer where people, tools, and tokens interact outside normal entitlement review. In governance terms, the organisation loses sight of who is using which AI service, what data it can reach, and which credentials it can consume or leak.
Practical implication: inventory AI use as an access-governance problem, not only as a software-sprawl problem.
Threat narrative
Attacker objective: Exploit unmanaged AI workflows to collect sensitive data, reusable credentials, and downstream access paths without triggering the controls built for approved systems.
- Entry begins when employees use unmanaged AI services or AI-enabled applications outside approved IT and security workflows.
- Credential exposure follows when MCP configuration files or similar artefacts store API keys and tokens that can be copied, synced, or reused.
- Impact occurs when sensitive data or credentials leave the organisation through AI interactions that conventional logging and monitoring never captured.
Breaches seen in the wild
- Vercel Context.ai OAuth Supply Chain Breach: Shadow AI app Context.ai OAuth integration exposes Vercel customer data via unmanaged third-party token.
- Samsung ChatGPT leak 2023: Samsung staff pasted chip source code and meeting notes into ChatGPT weeks after it was allowed, leading Samsung to restrict generative AI tools.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Shadow AI is now an access-governance problem, not just an application-discovery problem. Visibility matters, but the more material issue is that employees can create data and identity flows outside approved onboarding, entitlement review, and secret handling processes. Once AI use is unmanaged, the organisation no longer knows which identities, tokens, or data paths are participating in business activity. Practitioners should treat unmanaged AI as a governance boundary failure, not a niche tooling gap.
Encrypted browser traffic has created an AI visibility gap that legacy controls were not designed to close. The article’s most important point is not simply that traffic is hidden, but that conventional control placement assumes inspectable sessions and managed devices. When those assumptions fail, DLP and CASB can miss the bulk of activity. The field needs control models that start with discovery at the endpoint and identity layer, not only at the network edge.
Credential leakage inside AI workflows is the clearest NHI lesson in this article. API keys and tokens in MCP configuration files are machine identities in practice, even if teams treat them as developer convenience artefacts. That makes this a governance issue for NHI ownership, rotation, and offboarding, not just an AI security issue. The named concept here is AI secret sprawl: credentials dispersed across AI-connected workflows where normal lifecycle controls do not reach them. Practitioners should govern AI-connected secrets as first-class NHI assets.
Compliance controls do not stop Shadow AI when behaviour is already embedded in daily work. The article shows regulated industries still encountering unmanaged AI use despite policies and restrictions, which means policy-only programmes are not enough. Governance has to account for the practical path of least resistance that users will take when the sanctioned experience is slower or less useful. Security teams should expect policy bypass, then design controls that reduce the incentive to bypass them.
Exposure management is becoming the bridge between AI security and identity security. XM Cyber’s framing points to a broader market shift where discovery, credential tracing, and data-flow visibility converge. That convergence matters because the same workflow that reveals shadow AI also reveals unmanaged identities, hidden secrets, and unapproved access paths. Practitioners should align AI security with identity governance instead of running them as separate programmes.
From our research library:
- Organisations with high levels of shadow AI faced an average of $670,000 in additional breach costs compared with those with little or none, according to IBM's 2025 Cost of a Data Breach Report.
What this signals
AI secret sprawl is the operational failure mode this article exposes. When API keys and tokens are allowed to drift into MCP files, shared repositories, and prompt-driven workflows, the organisation loses control over machine credentials in exactly the places where humans expect convenience, not governance.
The right response is to treat Shadow AI as an identity and secrets problem as much as an AI security issue. That means discovery, ownership, and lifecycle controls have to move closer to the endpoint and development workspace, because network-centric monitoring will miss too much of the activity.
For IAM and PAM teams, the practical signal is that approval workflows now need to cover AI services as access paths, not just as applications. If an AI tool can ingest data, invoke APIs, or store secrets, it belongs inside the same governance model as other sensitive non-human identities.
For practitioners
- Map shadow AI discovery to endpoint and browser telemetry Correlate browser history, endpoint artefacts, and sanctioned application inventories to identify unmanaged AI use that network DLP cannot see.
- Inventory MCP servers and exposed AI credentials Look for API keys, tokens, and other secrets stored in MCP configuration files, shared repositories, and synced development workspaces.
- Classify AI services as governed access paths Treat every external AI service or AI-enabled application as a distinct access path with an owner, approved purpose, and review cycle.
- Extend secret rotation to AI development workflows Rotate and revoke credentials used in AI-assisted development when they appear in configuration files, copied prompts, or shared code stores.
Key takeaways
- Shadow AI creates a governance blind spot because users can move sensitive data and machine credentials into AI tools outside approved identity and monitoring controls.
- The most serious failure mode is credential exposure in AI-connected workflows, especially when API keys and tokens are stored in MCP files or shared repositories.
- Security teams need to govern AI usage as an access and secrets problem, with discovery, ownership, and lifecycle controls that reach unmanaged endpoints and developer workflows.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article centres on API keys and tokens leaking through AI-connected workflows. |
| NHI-07 — Long-Lived Secrets | Unmanaged AI usage becomes worse when credentials remain valid across unknown tools and workspaces. | |
| NHI-10 — Human Use of NHI | Employees are using human workflows to create machine credential exposure inside AI tools. | |
| Recommendation — Scan AI workflows for exposed secrets and revoke any credentials found in MCP files or shared repositories. Shorten secret lifetimes for AI-connected services and enforce rotation wherever usage is not tightly governed. Separate human-approved AI use from machine credential handling so users cannot casually move secrets into prompts or config files. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article links exposed AI credentials to downstream access and movement risk. |
| Recommendation — Map shadow AI secret exposure to credential access and lateral movement techniques in your detection pipeline. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article is fundamentally about governing uncontrolled AI use across the enterprise. |
| Recommendation — Define ownership, oversight, and acceptable-use rules for AI systems under your AI governance programme. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | API keys and tokens in MCP workflows are authenticators that need lifecycle control. |
| Recommendation — Apply authenticator management to AI-linked API keys and tokens, including rotation, revocation, and inventory. | ||
Key terms
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- AI-assisted Secret Sprawl: The spread of machine credentials through prompts, generated code, build scripts and logs as AI tools accelerate development. It becomes a governance problem when ownership, rotation and revocation no longer keep pace with where secrets are copied or persisted.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management for teams that need stronger control over non-human access paths. It helps practitioners connect identity governance to the operational realities of AI-connected systems and other machine-driven workflows.
Published by the NHIMG editorial team on August 2, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org