48.9k
Shadow AI is the use of AI tools, models, or AI-powered features inside an organization without the approval or oversight of IT, security, and governance teams. It is the AI-era successor to shadow IT. In IBM's 2025 Cost of a Data Breach report, 20% of breached organizations traced the incident to shadow AI, and those breaches cost an average of $670,000 more than breaches without it.
The scale is larger than most governance teams assume. Microsoft and LinkedIn's 2024 Work Trend Index, a survey of 31,000 knowledge workers across 31 markets, found that 75% already used generative AI at work and 78% of those users brought their own tools rather than waiting for a sanctioned option.
How does shadow AI happen?
Shadow AI enters an organization through three routes, and none of them passes through procurement or security review, so no inventory of AI usage exists. Each route has a different owner and a different fix:
- Bring-your-own AI (BYOAI): individuals use ChatGPT, Claude, or Gemini accounts for drafting, coding, and analysis. Samsung restricted generative AI use in May 2023 after engineers pasted internal source code into ChatGPT.
- Unsanctioned build-out: a team wires an LLM into a product or internal tool using a personal or project-level API key, skipping security review, evaluation, and guardrails.
- Embedded vendor AI: an approved SaaS product enables an AI assistant or model-training clause in an update, changing where company data flows without anyone opting in.
What are the risks of shadow AI?
Shadow AI creates four recurring classes of risk, and each one leaves an observable signal.
| Risk | Concrete example | Detection signal |
|---|---|---|
| Data exfiltration via prompts | An employee pastes customer records or source code into a public chatbot | Egress traffic to AI API endpoints from unmanaged devices; DLP hits on prompt payloads |
| Unvetted output in production | A team ships an LLM feature with no evaluation, review, or guardrails | Traces showing calls to unknown model endpoints; AI SDKs appearing in dependency scans |
| Unbudgeted API spend | A prototype on a personal API key becomes load-bearing and usage grows unmonitored | Token-spend anomalies; billing alerts on unrecognized API keys |
| Compliance exposure (GDPR, HIPAA) | Regulated personal or health data is processed by a vendor with no data-processing agreement | AI calls in audit trails with no mapped legal basis or access controls |
The access-control gap compounds every row: among organizations reporting AI-related breaches, IBM's 2025 Cost of a Data Breach report found 97% lacked proper AI access controls.
How is shadow AI different from shadow IT?
Shadow AI is a subset of shadow IT with a larger blast radius. Shadow IT is any unsanctioned technology, such as an unapproved SaaS subscription or a rogue server. Shadow AI adds risks shadow IT never had. Company data leaves inside prompts, output flows back into decisions and products, and cost scales per token rather than per seat.
A rogue project-management tool mostly leaks metadata about work. A rogue AI tool ingests the work itself (source code, contracts, customer records) and may retain it for model training depending on the vendor's terms. That asymmetry is why frameworks such as the NIST AI Risk Management Framework (AI RMF 1.0, January 2023) treat AI inventory and mapping as a distinct discipline instead of an extension of software asset management.
How do you detect shadow AI?
Shadow AI detection is an observability problem. The three signal classes are network egress to known AI endpoints, anomalies in token spend and API billing, and audit trails from a central AI gateway. Organizations that route AI traffic through logged infrastructure can answer "who used which model, with what data, at what cost" from telemetry.
In practice the data looks like any other event stream. An AI gateway or proxy emits one wide event per model call: timestamp, user, application, model, endpoint, input and output token counts, latency, and policy verdict. OpenTelemetry's GenAI semantic conventions standardize many of these attributes (such as gen_ai.usage.input_tokens), so the same instrumentation that powers AI agent observability doubles as a governance audit trail. Once the events are queryable, detection is aggregation:
-- Illustrative: weekly token spend by team and model
SELECT team, model, sum(input_tokens + output_tokens) AS tokens
FROM ai_gateway_logs
WHERE timestamp >= now() - INTERVAL 7 DAY
GROUP BY team, model
ORDER BY tokens DESCUnrecognized model values, spend from unknown teams, or egress that bypasses the gateway entirely are the shadow-AI findings.
How do organizations govern AI use?
Effective AI governance pairs a paved road with visibility. Four responses are standard:
- Sanctioned-tool catalogue: approved models and tools with clear data-handling terms, so employees have a compliant default.
- AI usage policy: what data classes may enter which tools, who approves new AI dependencies, and how violations are handled.
- Central gateway with logging: one egress point for model traffic that enforces authentication and emits the audit events described above.
- Framework alignment: NIST AI RMF's "Map" and "Measure" functions and ISO/IEC 42001:2023 both require an inventory of AI systems, which is impossible to maintain without telemetry.
Outright bans tend to push usage underground; the Work Trend Index's 78% BYOAI figure was measured in organizations that largely had no sanctioned alternative.
Monitoring AI usage with Langfuse
Langfuse, the open-source LLM observability platform that ClickHouse acquired in January 2026, is a natural home for the telemetry that shadow-AI detection produces. The gateway events described above map directly onto its trace model: each model call arrives with user, application, model version, token counts, and cost attached, so a token-spend anomaly and the exact prompts behind it live in the same interface. Cost monitoring, guardrail verdicts, and governance audit trails are the same LLM observability workload sharing one store instead of three, and because Langfuse runs on ClickHouse, the high-cardinality slicing this stream demands (thousands of users, API keys, and model versions) stays queryable at full fidelity. Langfuse is open source and free to self-host.
Frequently asked questions
Is shadow AI the same as shadow IT?
No. Shadow AI is the subset of shadow IT involving unsanctioned AI tools and models, and it raises the stakes because prompts carry company data out to a vendor while model output flows back into products and decisions. IBM's 2025 breach data prices that difference at $670,000 per breach.
Is shadow AI always bad?
No. Shadow AI usually signals unmet demand: employees adopt AI tools because sanctioned options are missing or slower. What makes it risky is the missing governance around it. Organizations that provide approved tools, a usage policy, and logged access convert most shadow usage into sanctioned usage without losing the productivity gains.
What is an example of shadow AI?
An engineer pasting proprietary source code into a public chatbot to debug it is the canonical example, and the incident that led Samsung to restrict generative AI tools in May 2023. Other examples include a team shipping an LLM feature on a personal API key and a SaaS vendor enabling AI processing by default.
How can a company detect shadow AI?
Route model traffic through a central gateway that logs every call with user, application, model, and token counts, then look for what doesn't fit: unrecognized models, unknown API keys, and spend anomalies. Network egress monitoring and API billing data catch the traffic that bypasses the gateway entirely.
