Unapproved generative AI is already in daily work. Spotting it means watching prompts, SaaS, and endpoints. Managing it means sanctioned tools people will actually use, plus controls that treat paste as a data path.
A product manager drops last quarter’s forecast into a free chatbot to “clean up the story.” A developer pastes an internal stack trace into the same kind of site. Neither request shows up in the official Copilot tenant, the MDM inventory, or last quarter’s SaaS review. The work still ships. That gap (tools the company never bought, already sitting in the workflow) is why shadow AI stopped being a side conversation for security and architecture teams.
A Gartner survey of 302 cybersecurity leaders, run from March to May 2025, found that 69% of organizations either suspect or already have evidence that employees are using prohibited public generative AI. The same research projects that by 2030, more than 40% of enterprises will see security or compliance incidents tied to unauthorized shadow AI. Those are not adjacent problems. They are the same control failure, measured first as usage and later as incident volume.
Pressure comes from three places at once. Consumer chat interfaces are good enough that people reach for them the way they once reached for personal Dropbox. Official enterprise AI programs are slower than a browser tab. And the data leaving those tabs is not a file share you can revoke. Once a prompt hits a third-party model, you do not get a clean rollback.
What “shadow AI” actually names
Palo Alto Networks describes shadow AI as the use of AI tools, systems, or agents without the approval, monitoring, or involvement of IT or security. That definition is useful because it is about governance, not model quality. A well-run open-source coder assistant on a laptop can still be shadow AI. A mediocre chatbot on a sanctioned tenant, with logging and data-handling terms the company accepted, is not.
It is easy to treat this as a new label for shadow IT. The overlap is real: unsanctioned SaaS, personal accounts, no owner, no contract. The difference that matters is what happens to the payload. Shadow IT usually means unsanctioned access or storage. Shadow AI means unsanctioned processing. Text, code, customer records, and screenshots are transformed by a system the organization does not operate, often under consumer terms that permit retention or training. You cannot pull that material back the way you deprovision a rogue Slack workspace.
Two other confusions show up in the same meetings. First, “we blocked chatgpt.com” is not a program. Traffic moves to other domains, mobile apps, browser extensions, and personal hotspots. Second, a Copilot or Gemini enterprise license does not automatically mean unsanctioned use has stopped. People still open the tool that answers fastest, especially when the official one is gated, slower, or missing a feature.
Local models sit on the boundary. A downloaded runtime on an engineering laptop may never leave the building, which changes the data-residency picture, but it still bypasses identity, acceptable-use, and evaluation controls. Agents with tool access (mail, tickets, repos, browsers) raise the same problem at a higher blast radius: the unsanctioned thing is no longer a paste box. It is something that can act.
How unsanctioned use actually shows up
Most shadow AI still starts as a person and a prompt. The inputs are whatever is on the clipboard or in a file picker: source, CRM exports, legal drafts, meeting notes, screenshots. The process is an HTTPS session to a consumer or freemium model, a browser extension that injects that session into every page, or a desktop app signed in with a personal identity. The output comes back as text the person pastes into a ticket, a pull request, or a customer email. From the company’s point of view, the decision was already made. The model influenced wording, code, or a recommendation with no record in the systems of record.
Detection, when it works, is pieced together from several observation points rather than a single “AI sensor.”
On the network path, secure web gateways and cloud access security brokers (CASBs) classify destinations the way they have classified shadow SaaS for years: domain, app catalog, user identity from the proxy, sometimes an API connector. Generative AI adds a payload problem those catalogs were not built for. Seeing that someone hit a chatbot domain is not the same as seeing that they uploaded a customer list. Data loss prevention (DLP) on that path only helps if the traffic is inspectable. Connections that use QUIC, or apps that pin certificates, can bypass TLS inspection depending on the gateway’s capabilities and configuration. Personal devices off the corporate VPN never hit that path at all.
On the endpoint, EDR and SaaS-discovery agents can inventory browser extensions, known desktop clients, and running processes. Tools that list processes can flag known local inference runtimes, though that depends on signatures and how the model was deployed. A renamed binary, a Python venv, or inference inside a container will not match a ChatGPT.exe rule.
In identity and SaaS logs, OAuth grants and “login with Google” events can reveal unsanctioned AI apps the proxy never saw, if those apps live in a managed identity. Consumer ChatGPT with a personal email will not.
A concrete pattern: Menlo Security’s 2025 report described heavy use of free-tier tools through personal accounts, with a majority of those users putting sensitive data into prompts, and it logged hundreds of thousands of copy and paste attempts in a single month in the environments it measured. That is the mechanism in miniature. The leak is often not an API integration. It is copy, paste, and a consumer terms-of-service checkbox.
Policy enforcement then splits. You can block a destination, rewrite a prompt, strip an attachment, force a sanctioned app, or alert after the fact. Blocking without a usable alternative just trains people to use phones. Alerting without prompt-aware DLP produces a queue of “someone used AI” events that nobody can triage.
Browser tabs were last year’s problem. Agents are this year’s.
The current, demonstrated pattern is still unsanctioned public chat: ChatGPT, Claude, Gemini, and a long tail of wrappers, reached from the corporate browser or a personal account. That is what the Gartner 2025 cybersecurity survey is measuring, and it is what most CASB “GenAI” dashboards are built to list.
What is changing in production is the shape of the client. Browser extensions sit in the page and capture text without a separate “go to the AI site” moment. Desktop apps and IDE plugins send repository context continuously rather than as a one-off paste. Some organizations now find employees running small models locally to avoid the official waitlist. Those are all current, if uneven, deployments. They are not lab demos.
Emerging over the next year or two is the agent and tool-calling layer: assistants that can read mail, open tickets, or call internal APIs, including through new protocol plumbing that lets models attach to tools. A handful of SASE and endpoint vendors have started shipping “shadow AI” dashboards and MCP-related gateways. Treat product announcements as intent until you can see them classifying your traffic, not as proof that agent governance is a solved category.
Speculative, and not something to staff a program around yet, is the idea that unsanctioned autonomous agents will quietly run the business while the official AI office is still writing a policy PDF. The near-term failure mode is more ordinary: a human still clicks send, but the draft, the code, or the customer summary came from a system with no contract, no retention clause, and no log.
IBM’s 2025 Cost of a Data Breach Report put a price on the oversight gap. Organizations with a high level of shadow AI (workers downloading or using unapproved internet-based AI tools) saw an extra USD 670,000 on the average breach cost. IBM’s read is operational as much as financial: AI-related incidents spread into data compromise and disruption of orders, service, and supply chain work. The report is not a claim that every unsanctioned prompt becomes a breach. It is evidence that when a breach does happen in a high-shadow-AI environment, the bill and the blast radius tend to grow.
The questions that tell you if you can actually see it
How will you know who is using AI, which model they reached, and what left the tenant? A useful answer is an identity-bound inventory: user, device posture, destination app, and whether the payload was inspected, not a monthly spreadsheet of “AI websites.” Technically, that means proxy or CASB coverage on the corporate path, SaaS discovery for OAuth grants, and endpoint visibility for local runtimes and extensions, with prompt-level DLP where inspection is possible. Look for an architecture that degrades honestly. If QUIC, pinned apps, or unmanaged phones are in play, the design should say what it will miss rather than implying full coverage.
If you block the popular chatbot, where does the work go the next morning? The honest answer is: to the next URL, a personal phone, an extension, or a local model, unless a sanctioned tool is faster for the same job. Blocking a hostname is a network control. Shadow AI is a workflow control. Evaluate whether the official assistant can see the same systems (mail, wiki, repo, tickets) under your identity provider, with logging you would accept in an audit. If it cannot, the block list is a delay, not a strategy.
Can you tell a prompt that contains source or customer data from one that asks for a better subject line? You need classification on the content, not only on the destination. A GenAI app catalog that labels “ChatGPT: unsanctioned” treats a recipe request and a pasted customer dump as the same event. Prompt-aware DLP, token or file-size thresholds, and policies that differ by data class are what make the queue usable. Look for controls that act inline (block, redact, route to the tenant model) rather than only alerting after the paste.
Who owns the inventory when legal, security, IT, and the business all think someone else has the list? A working answer names a system of record and a human owner, with a refresh cadence measured in days, not annual SaaS reviews. Shadow AI ages in hours. What to look for is a join between identity, procurement, and security telemetry, plus an exception path that is shorter than the underground alternative. If requesting access takes two weeks and the consumer site takes two seconds, you already know which one wins.
Inspection, endpoints, and a desk people will sit at
The market is splitting along the observation point, not along a single “shadow AI platform” category.
One approach extends the CASB and SASE stack that already hunted shadow IT: classify AI destinations, apply DLP, put a dashboard on GenAI use. Cato Networks added generative AI controls to Cato CASB in April 2025, including a shadow AI dashboard and a policy engine aimed at detecting and governing GenAI apps inside its SASE cloud. Zscaler is pushing the same problem through the Zero Trust Exchange, reusing CASB-style app discovery and adding inline AI controls on the proxy path rather than standing up a separate AI-only box.
A second approach starts on the endpoint and identity side: inventory AI clients, extensions, and process names, then tie them to a user. CrowdStrike has been building visibility services aimed at unsanctioned AI use and agent activity, which is a different bet. It assumes a lot of the interesting behavior never hits a corporate proxy in a form you can parse.
A third approach is the sanctioned desk. Microsoft, Google, and other enterprise suites are selling tenant-hosted assistants as the way to pull work off consumer chat. That is not detection. It is substitution. Palo Alto Networks sits closer to the first camp, treating unsanctioned AI as an app-and-data problem inside the broader network security stack rather than as a new product island.
None of these replace the others. A proxy that cannot see a phone, an EDR that cannot read a prompt, and a Copilot license that nobody prefers will each leave a hole the size of a daily habit.
Watch the sanctioned tool, not the ban list
The next 12 to 24 months will not be decided by who publishes the longest block list. They will be decided by whether official AI is good enough, logged enough, and close enough to the systems of work that staff stop pasting into the open internet. Gartner’s incident projection out to 2030 only holds if that substitution fails. If it works, a lot of “shadow AI” simply becomes governed AI with a worse user experience behind it.
Two signals are worth watching inside your own environment. First: the ratio of traffic to sanctioned tenants versus consumer AI domains, after you have offered a real alternative, not after you have sent a policy email. If the consumer line stays flat, you have a product problem, not a training problem. Second: whether your DLP and CASB tickets start naming data classes (source, PII, deal data) instead of only app names. App-name alerts mean you found the website. Data-class alerts mean you found the leak path.
The uncomfortable question for a CIO or CISO is not “did someone use ChatGPT.” It is whether the last material decision that went to a customer, a regulator, or a production repo can be traced to a model you can name, a prompt you can retrieve, and a contract you would still sign.