What Is Shadow AI? Definition, Risks and How to Find It

Shadow AI is any artificial intelligence tool, model or feature that employees use for work without the knowledge or approval of IT, security or governance teams. It includes personal chatbot accounts used with company data, niche AI apps signed up for with a work email, AI browser extensions, local models downloaded onto laptops, and AI features quietly switched on inside SaaS products you already pay for. It is the AI-era version of shadow IT, and it spreads faster because most AI tools are free, browser-based and useful within minutes.

The goal isn’t to stamp it out. Shadow AI usually signals real demand, and people use it because it helps them. The goal is to see it, understand the risk of each tool, and steer usage toward approved options that are just as easy to use.

The five common forms of shadow AI

1. Personal accounts on mainstream chatbots

An employee uses their personal ChatGPT, Claude or Gemini account to draft a customer email or summarize a contract. The tool may be fine. The account is the problem: consumer tiers usually have different data-handling defaults from enterprise tiers, there is no SSO, and when the employee leaves, the conversation history leaves with them.

2. Niche AI apps

Meeting transcribers, AI slide generators, résumé screeners, PDF chat tools, AI writing assistants. Thousands of them exist, many from small vendors with unclear retention policies and sub-processors. They tend to get adopted team by team, often on a corporate card.

3. AI browser extensions

Extensions that “summarize any page” or “rewrite any text box” may be able to read everything in the browser, including internal apps. They are easy to install and easy to forget.

4. AI inside sanctioned SaaS

Your CRM, help desk, design tool or note-taking app ships an AI feature, sometimes on by default, sometimes processed by a third-party model provider. The app was approved. Its AI feature may never have been reviewed.

5. Local and self-hosted models

Developers and data scientists run open-weight models on laptops or spare GPUs with tools like Ollama or LM Studio. No data leaves the device, which is good. But licenses, model provenance and what those models are connected to still matter.

Why shadow AI is a risk

Data leakage. The most immediate risk is sensitive information pasted into a tool the organization doesn’t control: customer records, source code, financial results before they’re announced, credentials, patient information. Once it is sent, you can’t recall it, and you may have no record that it happened.

Unknown data handling. Different tools and tiers treat inputs differently. Some use inputs for model improvement unless you opt out, keep data for varying periods, or process it in jurisdictions that matter to your regulators.

Compliance gaps. Regulations and frameworks increasingly expect organizations to know which AI systems they use. You can’t run an AI inventory, carry out an impact assessment or show AI literacy efforts for tools you don’t know about.

Wasted spend. Shadow AI often duplicates sanctioned tools. A team expenses a chatbot subscription while holding unused enterprise seats, or three departments buy three transcription tools.

Inconsistent quality. Outputs from unvetted tools feed into decisions, documents and code without any review of whether the tool suits the task.

Why blocking everything doesn’t work

The instinctive response, blocking every AI domain at the firewall, tends to fail for three reasons. First, the list of AI apps changes weekly, so blocklists are always behind. Second, people route around blocks with phones, personal laptops or home networks, which pushes usage somewhere you can see even less. Third, blanket blocking throws away real productivity gains, and leadership usually wants those gains.

A better model is see, assess, steer:

1. See every AI tool in use, who uses it and how much.
2. Assess each tool’s risk: data handling, security posture, enterprise options.
3. Steer usage: sanction the good tools, coach people away from risky ones toward an approved alternative, and block only where the risk justifies it.

How to discover shadow AI

Start with logs you already have

Your secure web gateway, firewall or DNS logs already contain AI destinations. Filter them against a list of AI domains for a quick first picture: which apps, roughly how many users, which departments. This is retrospective and coarse, but it costs nothing and sizes the problem. In PromptGlass you can import 30 days of proxy or DNS logs and produce a baseline report before deploying anything.

Add a browser sensor

Most shadow AI happens in the browser. A managed browser extension can tell personal accounts from corporate ones, spot AI chat interfaces on unfamiliar domains, and inventory other AI extensions. It also covers remote workers off VPN.

Add endpoint discovery for desktop and developer tools

Desktop AI apps, IDE assistants, command-line agents and local model runtimes don’t appear in browser telemetry. An endpoint agent inventories them.

Connect the AI features of sanctioned platforms

For Microsoft 365 Copilot, Gemini for Workspace, ChatGPT Enterprise, GitHub Copilot and similar tools, use the vendor’s admin and audit APIs. That shows where sanctioned AI is used, and how much of the AI activity in your organization happens outside it.

Assessing risk consistently

For each discovered app, ask the same questions:

• Are inputs used to train models by default? Can that be turned off for your organization?
• How long is data kept, and where is it processed?
• Is there an enterprise tier with SSO, SCIM, audit logs and a data processing agreement?
• Who are the sub-processors, including the underlying model provider?
• Does the vendor publish security attestations?

A shared catalog that tracks these attributes, like the continuously updated AI app catalog in PromptGlass, saves every security team from researching the same vendors again. Scoring apps (low, medium, high, critical) lets policy refer to risk tiers instead of individual apps.

Steering instead of blocking

Once you know what’s in use, decide per app: sanctioned, tolerated or prohibited. Then design the experience for each:

• Sanctioned: make it the easiest path. Provision it with SSO, announce it, publish prompt templates for common tasks.
• Tolerated: allow it, but coach people not to use sensitive data in it, and redact automatically where possible.
• Prohibited: show a clear message explaining why, with a one-click link to the approved alternative.

Coaching at the moment of use, a short message appearing just as someone pastes customer data into a personal chatbot, changes behavior more reliably than an annual policy acknowledgement. Track how often people override coaching and why. A high override rate usually means the approved tool is missing something people need.

A 30-day plan

• Week 1: import existing proxy and DNS logs to produce a shadow AI baseline. Share it with leadership.
• Week 2: deploy a browser extension to a pilot group in log-only mode. Connect your sanctioned AI platforms’ admin APIs.
• Week 3: review the top 20 apps by user count and decide on each. Publish the approved list.
• Week 4: turn on coaching for personal accounts and high-risk apps. Measure the shift toward sanctioned tools.

Shadow AI won’t disappear, because new tools arrive every week. With continuous discovery and a steady way of steering usage, it stops being a blind spot and becomes a signal of what your organization needs next.