Shadow AI outpaces enterprise governance as AI use spreads

At a glance

What this is: Tumeryk argues that Shadow AI is now an enterprise governance problem, not just an employee productivity trend, because unsanctioned AI use is already exposing sensitive data and creating unmanaged agent activity.

Why it matters: For IAM and security teams, the key issue is that personal AI accounts and agentic tool use weaken identity-based controls, audit trails, and data governance at the point where work actually happens.

By the numbers:

• Roughly 78% of AI users at work are bringing their own AI tools, according to Tumeryk.

Context

Shadow AI is the use of AI models, assistants, copilots, browser extensions, and agents inside an organisation without formal approval, visibility, or governance. It creates a control gap because the organisation may own the data and the risk, but not the account, device, or model interaction where that risk appears.

The problem is no longer limited to unapproved SaaS usage. When employees paste source code, contracts, financial models, or customer data into personal AI tools, traditional access policy and logging models no longer capture who touched what, where it went, or whether the system retained it for training.

Key questions

Q: How should security teams govern shadow AI without blocking productivity?

A: Use visibility-based controls instead of blanket bans. Identify which tools are in use, who is using them, and what data they can access, then apply targeted policies by role and data sensitivity. That approach preserves legitimate AI adoption while reducing exposure from unsanctioned tools and unreviewed data paths.

Q: Why do endpoint agentic AI tools create more governance risk than chat-only GenAI?

A: Endpoint agentic AI can act inside a user’s session, move data, and trigger downstream actions, which expands the effective privilege boundary. Chat-only tools may still create data risk, but agents can combine access and action in ways that are harder to see and easier to over-scope. That makes workflow control and telemetry more important than simple application approval.

Q: What are the signs that shadow AI is already operating in an organisation?

A: Common signs include sudden productivity jumps in a team, unusual data uploads to external AI platforms, and unexplained API calls or suspicious queries to third-party services. These signals often indicate that employees are using unauthorized tools outside IT visibility. The practical response is to investigate data flows, user behaviour, and application logs together.

Q: How do data governance and identity governance intersect in AI programmes?

A: They intersect at the point where systems decide what data to trust and who is accountable for that trust. Identity teams bring ownership, approval and review discipline, while data governance brings classification, lineage and context. AI programmes need both, because access without trustworthy context still produces poor decisions.

Technical breakdown

How Shadow AI breaks identity-based control

Shadow AI bypasses the normal enterprise identity stack because the user often authenticates with a personal account on a personal device rather than through corporate identity controls. That breaks conditional access, limits auditability, and removes the organisation’s ability to enforce role-based policy at the point of use. The risk is not just the model itself, but the fact that prompts can carry sensitive data into an external system that the enterprise does not administer. Once the interaction leaves governed identity boundaries, security teams lose visibility into subject, tool, and data context. See the Shadow AI and AI Agent Discovery Guide.

Practical implication: Treat unauthorised AI access as an identity governance problem, not only a data leakage issue.

Why agentic AI changes the governance model

Agentic AI changes the security model because it does not just generate content. It can call tools, invoke APIs, query repositories, and take actions on behalf of a user or workflow. That creates delegated authority chains that look unlike ordinary SaaS use, especially when one agent calls another or when a model uses Model Context Protocol to reach internal systems. Existing controls such as firewalls and SIEMs can see events, but they do not understand the semantic decision to act, which means policy has to move closer to prompt, tool, and action governance. See the AI Agent Tool and Plugin Security Guide.

Practical implication: Map agent actions to delegated authority and scope them like privileged non-human activity.

Why observability is the real control plane

AI observability is the ability to see prompts, responses, tool calls, and data flows in real time. It becomes the practical control plane for Shadow AI because organisations cannot set policy on what they cannot observe. Discovery tells you which tools exist, but observability tells you what those tools are doing with corporate data and whether the interaction crosses policy boundaries. In this environment, audit records are no longer optional evidence; they are the only defensible basis for review, incident investigation, and governance reporting. See the Generative AI Data Loss Prevention Guide.

Practical implication: Build monitoring around prompt and tool-call activity, not just network traffic or endpoint events.

Threat narrative

Attacker objective: The attacker or risky user objective is to extract value from enterprise data and workflows through a channel that security teams cannot easily see or govern.

1. Entry occurs when employees adopt personal AI tools, browser extensions, or agentic assistants outside approved procurement and identity controls.
2. Credential and data exposure follow when users paste contracts, source code, financial records, or customer data into models that may log or retain content.
3. Escalation happens when agentic systems gain tool access, query internal systems, or chain actions across applications without central oversight.
4. Impact is enterprise data leakage, unmanaged automation, and loss of provable control over who or what is using corporate information.

Breaches seen in the wild

• Samsung ChatGPT leak 2023: Samsung staff pasted chip source code and meeting notes into ChatGPT weeks after it was allowed, leading Samsung to restrict generative AI tools.
• Vercel Context.ai OAuth Supply Chain Breach: Shadow AI app Context.ai OAuth integration exposes Vercel customer data via unmanaged third-party token.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Shadow AI is now a governance failure, not a user-behaviour issue. The central mistake is treating unsanctioned AI use as a policy compliance problem when it is actually an identity and access control problem. If the organisation cannot bind the user, device, model, and data flow together, it cannot govern the activity at all. That makes discovery and auditability the minimum viable control, not an optional enhancement.

Shadow automation is the more serious second wave. Once AI tools can call APIs, query repositories, and invoke other agents, the risk shifts from data exposure to delegated action. That means the control question is no longer only what users paste into prompts, but what an AI system is authorised to do after it authenticates. Agent tool and plugin security becomes relevant because tool scope and validation now determine whether a model is merely helpful or operationally dangerous.

Visibility trust gap: organisations are still assuming that they can monitor AI through the same lens they use for SaaS and endpoint activity. Prompt-driven work breaks that assumption because the decision boundary sits inside the interaction, not around it. The right governance model has to see the prompt, the model, the tool call, and the resulting data movement as one control surface.

AI-to-AI interactions create a new non-human identity problem. When one agent invokes another, traditional human-centric review and approval workflows no longer map cleanly to the risk. That makes agent identity, delegated authority, and action logging central to future AI governance programmes. The practitioner implication is clear: govern agents as first-class identities, or they will operate outside the security model by default.

From our research library:

• Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
• Read next: Shadow AI and AI Agent Discovery Guide

What this signals

Shadow AI discovery is becoming a baseline control. As more work moves into personal AI accounts and embedded copilots, organisations need to identify where models, extensions, and agents are operating before they can govern behaviour. The next control layer is not just inventory, it is understanding which interactions cross data, identity, and policy boundaries.

Agentic AI raises the privilege question inside everyday workflows. When tools can query systems or take actions on behalf of users, the governance challenge stops looking like content moderation and starts looking like delegated authority management. Organisations that still treat AI as a single application category will miss the non-human access paths that matter most.

AI governance debt: the longer an organisation allows unmanaged AI use to spread, the harder it becomes to reconstruct who used what, with which data, and under which policy. That gap compounds quickly because policy, logging, and ownership are usually added after adoption, not before it. The practical response is to make observability and policy enforcement part of the rollout model from day one.

For practitioners

• Define an approved AI tool baseline Publish a sanctioned list of models, copilots, extensions, and agent platforms, then block or review everything else through policy and access controls.
• Inventory every AI interaction path Identify where employees use personal accounts, browser extensions, IDE plugins, and embedded copilots so you can see which data paths are actually in use.
• Move controls to the prompt and tool layer Set policy for what data can be entered, which tools agents may call, and which actions require review before execution.
• Add AI observability to audit workflows Log prompts, responses, tool calls, and high-risk data movements so compliance and security teams can reconstruct AI activity after the fact.
• Classify agentic AI as delegated access Apply identity governance to AI systems that act on behalf of users, including scope limits, approval boundaries, and revocation paths.

Key takeaways

• Shadow AI is creating an enterprise control gap because employees are already using personal AI tools and agents outside approved governance.
• The risk is not limited to data leakage, because agentic systems can also call tools and act on behalf of users without normal visibility.
• Security teams need discovery, observability, and prompt-level policy enforcement if they want AI use to remain governable.

Related NHI Mgmt Group resources: Shadow AI and AI Agent Discovery Guide · AI Agent Tool and Plugin Security Guide · Samsung ChatGPT leak 2023 · Vercel Context.ai OAuth Supply Chain Breach

Key terms

• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• AI observability: AI observability is the ability to see how AI systems are being used, what information they process, and what actions they trigger. In security programmes, it extends beyond uptime or model quality to runtime visibility, policy enforcement, and audit evidence across human and agent-driven use cases.
• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Delegated Authority Model: A delegated authority model defines who is allowed to approve, review, or execute control-related decisions across the enterprise. It helps ensure requests reach the correct responsible party, especially when control owners, managers, and process owners sit in different teams, regions, or systems.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management alongside the identity patterns that now shape AI governance. It is a practical fit for teams building controls across human, machine, and agentic access.