Employees are quietly feeding company secrets into AI tools no one approved. The data doesn’t just leak, it learns.

Cast your mind back to when employees first started using Dropbox without asking IT. The reaction was immediate and predictable – panic, policy memos, blanket bans. Files were escaping company servers. Compliance teams lost sleep. And yet, slowly, organizations figured it out. They built guardrails, rolled out sanctioned tools, and life moved on.

We are standing at an almost identical crossroads today. Only this time, the stakes are considerably higher, the tools are far more capable, and the risks are less visible which is exactly what makes them more dangerous.

This is the era of Shadow AI. It happens when employees reach for AI tools – ChatGPT, Gemini, Copilot, and dozens of others on their own initiative, without company approval, simply because those tools help them get things done. They paste in a client contract to get a quick summary. They feed in quarterly sales figures to write a polished report. They drop in a confidential product roadmap and ask the AI to break it down into talking points.

None of it is malicious. Almost all of it is well-meaning. And that is precisely what makes it so difficult to address.

1 in 5 organizations  suffered a data breach directly tied to shadow AI in 2024–25.

$670,000 extra  is what those breaches cost on average compared to standard incidents.

47% of employees  using AI tools are doing so through personal accounts their company cannot see, control, or audit.

It’s not just a data leak, it’s a training leak

Traditional shadow IT was risky, but the mechanics of the risk were familiar. A file ends up in the wrong place. You find it, move it, lock it down. There is a clear remediation path.

AI operates on an entirely different logic. When an employee pastes confidential information into a consumer AI tool, that data may not simply pass through and disappear. Depending on the provider’s terms of service — terms that very few employees actually read that content could be used to train future versions of the model. Which means your business strategy, your client data, your unreleased product roadmap could quietly become part of a model that millions of people query every single day.

The scenario that should keep executives awake at night is not the one with a clear paper trail. It’s the subtle one: a competitor asks an AI a routine question, and the answer comes back with details that feel a little too informed, a little too specific. Nobody can prove anything. The model’s training data isn’t published. But the competitive edge your organization spent years building has quietly seeped out through a chat interface.

“The problem isn’t that employees are doing something wrong. It’s that the tools are so good, and the guardrails so invisible, that nobody thinks twice before hitting send.”

Two real examples from 2025

Example 1: Microsoft Copilot’s EchoLeak

In mid-2025, security researchers uncovered a serious vulnerability in Microsoft 365 Copilot that became known as EchoLeak. The attack vector was almost elegantly simple: a malicious actor could embed an invisible instruction inside an ordinary-looking email. When an employee later asked Copilot a routine work question, the AI would silently locate and exfiltrate sensitive files without the employee doing anything suspicious, clicking anything unusual, or receiving any kind of warning.

Microsoft moved quickly to patch the flaw. But the episode left behind a lesson that no patch can fully address: even an officially approved, enterprise-grade AI tool can quietly become a data exfiltration channel if it isn’t actively monitored. The same reporting period found that Copilot had already accessed close to three million sensitive records per organization in just the first half of 2025. The U.S. Congress had already banned their staff from using the tool in 2024, citing precisely these data-boundary concerns.

Example 2: The personal account problem hiding in plain sight

A 2025 Netskope study revealed that nearly half of all employees using AI tools at work are doing so through personal accounts. Accounts that their employers have no visibility into, no ability to audit, and no way to control. These employees are not acting out of defiance. Most of them simply signed up for ChatGPT one evening on their phone, found it genuinely useful, and kept using it. The line between personal and professional tool dissolved before anyone thought to draw it.

IBM’s 2025 breach report put hard numbers to where this leads. One in five organizations had already experienced a security breach tied to unsanctioned AI use. In 40 percent of those cases, intellectual property had been exposed. In 65 percent, it was customer data. These are not hypothetical scenarios or worst-case projections. They are last year’s incident reports.

Why a ban will not fix it

The instinct, when confronted with this kind of risk, is to shut things down. Issue a policy. Block the websites at the network level. Move on.

The problem is that it simply does not work. These tools are trivially easy to access on a personal phone, a home laptop, or a coffee shop WiFi connection. Banning AI at work is structurally similar to banning Google. People will route around it, and in doing so, you will lose their trust without actually reducing the risk. You will just push the behavior somewhere you can no longer see it.

The Netskope data confirms this. Personal AI use actually increased in organizations that tried to restrict it. A ban does not change the underlying dynamic employees who find a tool useful will keep using it. All a ban does is remove your ability to shape how that happens.

What actually works

The organizations navigating this well are not the ones with the most restrictive policies. They are the ones who started by asking honest questions about what was already happening inside their walls.

• Find out what’s already happening. Run an anonymous survey. Have real conversations with managers. IBM found that 63 percent of organizations that experienced a breach had no AI governance policy in place at the time it occurred. You cannot design a response to a problem you haven’t honestly mapped.
• Give people a safe option that actually works. If employees are turning to ChatGPT because it makes them faster and better at their jobs, the answer is not to take it away. It’s to provide an approved alternative an enterprise AI tool with proper data controls, clear terms, and boundaries that protect both the employee and the organization. Prohibition without a viable substitute is not a policy. It is a gamble.
• Teach people what the risk actually is. Most employees have no idea that the prompts they type into a consumer AI tool could be used to train the next public version of that model. Most assume it works more like a calculator than a data pipeline. Once they understand the actual mechanics, they make different choices. A single honest conversation about how these tools work does more lasting good than a twelve-page acceptable use policy that nobody reads.
• Review your policies on a real schedule. At minimum, every quarter. The EchoLeak vulnerability was discovered and patched within months but only organizations actively monitoring their AI environment would have known it was relevant to them. The landscape is moving too fast for annual reviews. Whatever policy you wrote six months ago may already be describing a world that no longer exists.

The mindset shift that matters most

The leaders handling this well share a particular quality. It is not that they are the most cautious or the most technically sophisticated. It is that they are the most curious. They approached Shadow AI not as a threat to be neutralized but as a signal worth understanding.

Because that is what Shadow AI actually is. It is a signal. It tells you that your people want to work smarter, that the tools they have been given officially are not fully meeting that need, and that they are motivated enough to go find something better on their own. That is not a workforce problem. That is an opportunity if you engage with it rather than suppress it.

Only 37 percent of organizations currently have any policy in place to manage or detect shadow AI. The remaining 63 percent are operating on the assumption that it isn’t happening inside their organization, an assumption the data does not support.

The question is no longer whether AI is being used inside your organization. It is. The only question worth asking now is whether you are the one deciding how