Shadow AI: New Security Risks for Organizations

Shadow AI is creating new security risks for organizations, going beyond the familiar challenges of shadow IT. This involves employees using unapproved AI tools, public models, and third-party integrations without oversight. Here's the thing: while shadow IT involved unsanctioned tools like personal cloud storage, shadow AI focuses on unapproved AI applications and features. This includes signing up for AI SaaS tools, using browser extensions, or activating AI capabilities embedded in existing software. The distinction matters because the risk is different. An unsanctioned AI tool can expose sensitive information like proprietary code, customer records, or financial figures, with no visibility into how that data is used. What's interesting is the rapid adoption of AI. A survey found that 84% of developers are using or planning to use AI tools. This widespread use, combined with thin governance, creates a significant attack surface that many enterprises are not prepared to defend. For example, malicious model files have been found on platforms like Hugging Face, which hosts over 2 million models. One campaign, called "nullifAI," used a compression quirk to bypass security scans, deploying a reverse shell. The bottom line: security teams need to monitor AI use and apply stronger governance to models, OAuth grants, and integrations to reduce their exposure to these evolving threats.