Shadow AI outpaces governance as unsanctioned tools spread

At a glance

What this is: This is a Zero Networks analysis of shadow AI, showing that unsanctioned tools are outpacing policy, visibility, and enforcement across the enterprise.

Why it matters: It matters because IAM, NHI, and security teams now have to govern AI usage that behaves like both a tool sprawl problem and an identity control problem, especially where agents and integrations expand access without approval.

By the numbers:

• Nearly 90% of organisations now use AI in at least one business function.
• Only 22% of individuals rely exclusively on tools provided by their employers.

Context

Shadow AI is any AI tool or application used without formal IT and security oversight or approval. In this article, Zero Networks argues that the problem is no longer limited to unsanctioned chatbots or browser use, because AI agents, embedded LLM features, and unmanaged integrations can all create hidden access paths inside the enterprise.

The governance gap is wider than discovery alone. If an organisation cannot inventory which AI tools, agents, and connections exist, it cannot set scope, restrict reach, or prove policy adherence for frameworks such as NIS2, DORA, or CIS Benchmarks.

For identity teams, the key question is not whether AI is present but whether its access is visible, bounded, and revocable. That makes shadow AI a governance issue that cuts across human access, machine identities, and the emerging controls needed for autonomous behaviour.

Key questions

Q: What breaks when organisations cannot see shadow AI usage?

A: When shadow AI is invisible, security teams lose control over where data is sent, which assistants are connected, and whether those systems can retain or expose sensitive information. That undermines policy enforcement, auditability, and incident response. It also means the organisation may be granting machine-driven access without a defined identity lifecycle.

Q: Why do unsanctioned AI tools increase lateral movement risk?

A: Unsanctioned AI tools often sit inside trusted networks while connecting to APIs, internal systems, and external services with more reach than their stated purpose requires. If an attacker compromises that tool or abuses its trust relationship, they inherit a path across systems that segmentation was meant to limit. The risk rises when permissions and destinations are not explicitly bounded.

Q: What are the signs that AI governance is failing in the enterprise?

A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk. Another indicator is weak visibility into who is using which tools and what data they are sending. If teams cannot answer those questions, governance is not working as intended.

Q: How should teams respond when AI is embedded in a sanctioned business tool?

A: Treat it as a governance change, not just a product feature. Review data handling, retention, approval boundaries, and ownership before broad rollout, and make sure the embedded AI path is visible in audit logs and identity records.

Technical breakdown

How shadow AI creates hidden access paths

Shadow AI expands the number of places where identity can connect, authenticate, and move data. Unsanctioned tools often reach corporate systems through browser sessions, APIs, embedded connectors, or agent-to-service interactions that are not captured in approved inventories. That makes the control problem different from classic shadow IT, because the issue is not only device or application ownership but the identity relationships those tools establish. Once those relationships exist, they can persist even when the original use case changes or the owner leaves. The result is an access graph the security team did not approve and may not be able to see.

Practical implication: Map every AI-related connection to an owner, a purpose, and an explicit approval state.

Why AI agents change the privilege model

An AI agent is not just another app because it can accumulate permissions over time as it chains tasks, reaches new tools, and expands scope. That creates privilege drift, where the agent’s effective access becomes broader than the original task required. In identity terms, this is a problem of standing scope without a stable review point. Traditional governance assumes access can be reviewed against a relatively fixed entitlement set, but agents can alter what they touch from one session to the next. The governance target becomes runtime scope, not static assignment.

Practical implication: Treat agent permissions as mutable runtime scope and review what they can reach, not just what they were assigned.

Why network controls remain necessary for shadow AI

The article’s central technical point is that many AI interactions look like normal traffic unless the security team has continuous visibility into asset-to-asset and identity-to-asset communication. Proxy-based and application-layer controls were built for known browsers and sanctioned SaaS use, not for every hidden AI service, API call, or embedded assistant. That leaves a blind spot where unsanctioned AI can reach internal systems without standing out. Real-time network visibility does not solve governance by itself, but it is often the only way to surface what policies failed to enumerate.

Practical implication: Use live traffic monitoring to identify unapproved AI destinations before those connections become normalised.

Threat narrative

Attacker objective: Gain covert access to corporate data and internal systems through AI-driven trust relationships that were never formally governed.

1. Entry occurs when users, developers, or third-party tools introduce unsanctioned AI services or embedded assistants into the environment without formal oversight.
2. Credentialed access then expands as those tools connect to internal systems, SaaS applications, and external APIs with permissions that are often broader than the stated use case.
3. Escalation follows through policy drift and tool chaining, where an AI agent accumulates additional reach over time and creates a larger lateral movement surface.
4. Impact is realised when the unsanctioned AI path provides attackers or insiders a hidden route to corporate data, internal systems, or production-connected workflows.

Breaches seen in the wild

• Vercel Context.ai OAuth Supply Chain Breach: Shadow AI app Context.ai OAuth integration exposes Vercel customer data via unmanaged third-party token.
• OmniGPT breach claim 2025: A hacker claims to have leaked 34 million OmniGPT AI chat messages holding users' API keys and credentials; OmniGPT has not confirmed it.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Shadow AI is now an identity governance problem, not just a discovery problem. The article shows that unsanctioned AI creates access paths, not only unknown applications. Once AI tools and agents can touch data, APIs, and internal systems, governance has to track who or what is allowed to connect, under what approval, and with what revocation path. Practitioners should treat shadow AI as an entitlement issue that extends beyond inventory.

Ephemeral AI behaviour exposes a runtime governance gap. Access review programmes assume the subject of review remains stable long enough to be recertified. Shadow AI agents can acquire and discard reach through task chaining, so the entitlement state that exists at review time may no longer be the state that exists in production. The implication is that governance must move closer to issuance and runtime control rather than relying on periodic certification alone.

Shadow AI creates a new lateral movement surface inside otherwise trusted environments. The article’s point is not that AI is inherently malicious, but that over-permissioned AI can become a bridge across systems the enterprise already trusts. That matters because trust boundaries were usually designed around users and approved applications, not autonomous or semi-autonomous interactions between tools. Practitioners should assume that AI can collapse segmentation if its reach is not explicitly constrained.

Policy without enforcement does not govern AI. The article argues that organisations can write policies faster than they can detect and block unsanctioned use. That leaves a familiar compliance failure: documented intent with no operational proof. The named concept here is shadow AI enforcement gap: the distance between AI policy statements and the technical controls needed to make them real. Security teams should close that gap by binding policy to visible connections and explicit identity scope.

Least privilege for AI must account for expanding task scope. An AI agent is a process with an identity, but its operational need can grow during execution in ways a static entitlement model does not anticipate. That does not mean abandoning least privilege, it means rethinking how scope is measured and bounded when the actor can move across tools, services, and data paths inside one workflow. The practitioner conclusion is to govern the tool reach, not the brand of the tool.

From our research library:

• Organisations with high levels of shadow AI faced an average of $670,000 in additional breach costs compared with those with little or none, according to IBM's 2025 Cost of a Data Breach Report.

What this signals

Shadow AI enforcement gap: policy language is no longer enough when AI services can be adopted faster than inventories are updated. Security teams need observable control points that tie approval status to real network behaviour, or shadow AI will continue to look like ordinary use until something fails.

The more important question is not whether AI is in the enterprise, but whether the enterprise can prove which AI identities, tools, and integrations are allowed to touch which assets. That is now a core identity governance requirement, not a side effect of application sprawl.

For practitioners

• Inventory AI connections continuously Map every AI-related identity, destination, and integration from observed traffic rather than relying on declared tool lists or project registers.
• Block unapproved SaaS AI destinations Define an approved list of AI services and deny connections to any SaaS AI destination outside that list across users, devices, and workloads.
• Scope agent permissions to task need Review each AI agent for what it can reach across CRM, production systems, and external APIs, then reduce permissions to the narrowest operational requirement.
• Automate AI policy lifecycles Tie policy updates to network changes so new AI tools, connectors, and agents are evaluated and governed as the environment changes.

Key takeaways

• Shadow AI is a governance failure as much as a discovery failure, because unsanctioned tools can create persistent access paths without formal approval.
• The article ties shadow AI to broader exposure, including lateral movement risk and compliance gaps, which makes the issue operational rather than theoretical.
• Effective control requires continuous visibility, explicit least privilege for AI agents, and enforcement that follows policy rather than assuming policy will be followed.

Key terms

• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• AI Agents: AI agents are autonomous software entities that act within organisational environments and make runtime decisions within assigned boundaries. They can hold identities, authenticate to systems, and exercise permissions, which makes them comparable to other non-human identities that require inventory, governance, and continuous activity monitoring.
• Access Path Proliferation: Access path proliferation is the growth of new routes by which identities, tools, and services can reach internal systems, APIs, and data. It matters because each new route creates a governance surface that can become persistent, over-permissioned, or invisible to review.
• Policy-To-Enforcement Gap: The policy-to-enforcement gap is the distance between what an organisation says should happen and what its systems actually prevent or allow. In AI environments, this gap appears when legal, compliance, and security work separately, leaving no single owner for translating policy into operational controls.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.