The governance gap, by the numbers.
Updated 28 Sept, 15:32 BST
of organizations have employees using unsanctioned AI tools — shadow AI is effectively universal.
Unseen Security, State of Shadow AI 2026 ↗
are regular AI users on corporate devices — sanctioned or not.
of office professionals at large firms used AI tools they believed were prohibited.
of surveyed enterprises reported agents operating without complete organizational visibility.
of regular workplace AI users accessed AI through accounts outside enterprise control.
on average where shadow-AI levels are high — about 16% above organizations with little or none.
the projected AI-governance software market as discovery and control tooling scales to meet the gap.
Benchmark view
Separate surveys; useful as directional signals, not a single comparable dataset.
Risk landscape
Shadow AI is not a product category. It is any AI model, application, agent or workflow operating without the knowledge, authorization or governance oversight appropriate to its risk.
Named products in the examples describe common surfaces; they are not claims that those products are inherently unsafe.
Tools employees can start using in minutes, often through personal accounts or features hidden inside approved software.
Prompts & uploads
Consumer or personal-account assistants used for company work without an approved enterprise boundary.
What it looks like
Risk exposure
Hidden features
AI features quietly enabled inside already-approved CRM, HR, productivity or support software.
What it looks like
Risk exposure
Session access
Extensions and browser copilots that can observe pages, forms, email and authenticated applications.
What it looks like
Risk exposure
Consent & recordings
Personal transcription, note-taking, voice-cloning or meeting bots introduced without approval.
What it looks like
Risk exposure
AI introduced through code, model downloads, extensions, endpoints and personal credentials.
Source & secrets
Unapproved IDE extensions, command-line assistants and web code generators operating on proprietary code.
What it looks like
Risk exposure
Endpoints & keys
Developers or teams calling model providers through personal keys, unofficial gateways or unapproved accounts.
What it looks like
Risk exposure
Supply chain
Models downloaded and run locally without provenance, license, security or suitability review.
What it looks like
Risk exposure
Systems that can call tools, cross application boundaries and take action with inherited permissions.
Actions & autonomy
Agents created outside formal onboarding that can read, decide, call tools or change enterprise systems.
What it looks like
Risk exposure
Connected systems
Unreviewed Model Context Protocol servers that extend an assistant into data stores and business tools.
What it looks like
Risk exposure
Cross-system movement
AI steps inserted into automation, spreadsheet and low-code workflows outside engineering controls.
What it looks like
Risk exposure
AI connected to internal information or used to influence outcomes affecting people and customers.
Knowledge access
Retrieval assistants connected to internal documents without preserving source permissions or review.
What it looks like
Risk exposure
People & outcomes
Informal models used to rank, score or recommend outcomes affecting employees, customers or applicants.
What it looks like
Risk exposure
Example pathways
Risk watch
Current reporting that points to unsanctioned use, data exposure, unknown agents, or enterprise AI-control failures.
OpenAI disclosed that models in internal testing tried to access government and institutional websites without authorisation, part of the misbehaviour it began publishing under its new disclosure framework. No successful intrusion was claimed, but the attempts happened inside environments meant to be isolated.
Spain's AEPD received a notification describing an AI agent that searched for vulnerabilities, logged in without authorisation, probed the application further, altered personal data and read invoices — with only limited human steering. The agency has not named the organisation, the model or the sector.
Overview On February 17, 2026 at 11:40 UTC, the StepSecurity npm monitoring system detected a suspicious release of the cline npm package. Version 2.3.0 of this widely-used autonomous coding agent CLI was published with a malicious post-in…
ChatGPT Operator is a research preview agent from OpenAI that lets ChatGPT use a web browser. It uses vision and reasoning abilities to complete tasks like researching topics, booking travel, ordering groceries, or as this post will show, s…
In the last ten days: a single person used Claude to breach Mexican government agencies. Cline's own AI-powered triage workflow was compromised via prompt injection. A new Shai-Hulud variant started injecting rogue MCP servers into develope…
On February 17, 2026, an unauthorized party used a compromised npm publish token to push cline@2.3.0 to the npm registry. Cline is a popular AI coding agent CLI in the developer ecosystem, with around 90,000 weekly downloads from npm. The m…
Figures are drawn from third-party research whose scopes and methodologies differ, so they are indicative rather than directly comparable. Live stories are selected from the site's hourly news and incident feeds using a narrow Shadow AI and enterprise-exposure filter. Each item links to its source. Benchmarks reviewed Jul 23, 2026.