Shadow AI is the use of AI tools by employees without approval, visibility or governance from the security team. Okta found that 68% of CISOs see at least some unsanctioned AI use in their organizations. Unlike shadow IT, shadow AI doesn't just introduce new assets — it actively copies code, credentials and internal data into places the organization doesn't control.
- 68% of CISOs report unsanctioned AI use (Okta, July 2026, 306 CISOs). Only 47% are confident they can even identify all AI agents operating in their environment.
- One in five organizations that reported a breach attributed it to shadow AI. Those breaches cost $670,000 more on average (IBM, 2025).
- Vibe coding — writing applications with AI tools in minutes — is the 2026 version of shadow IT. Code ships with no code review, no security review, and often with secrets baked in.
- GitGuardian found 28.65 million new secrets on public GitHub in 2025, a 34% increase. AI-assisted commits leak secrets at 3.2%, more than double the 1.5% baseline.
- The perimeter of the organization now ends at the personal accounts and AI-generated projects of its employees. Most security teams don't know this yet.
What is shadow AI?
Any use of AI tools that happens outside the visibility and governance of the security team. It includes an engineer pasting source code into ChatGPT for debugging help. A product manager building an internal dashboard with an AI coding assistant. An employee using an MCP server that connects to internal systems through personal credentials. A contractor running code-generation tools that copy context from private repositories to external services.
Shadow IT was about hardware and SaaS that the IT team didn't know about. Shadow AI is about tools that actively process, copy and sometimes publish your organization's code and data — at a speed and scale that a human copying files to a USB drive never approached.
Microsoft's Work Trend Index 2024, surveying about 31,000 workers across 31 markets, found that 78% of AI users bring their own AI tools to work. Gartner's survey of 302 cybersecurity leaders found that 69% suspect or have evidence of prohibited public GenAI use in their organization.
How bad is the problem?
The numbers paint a clear picture. Okta's Global CISO Insights 2026 report, based on 306 CISOs across the UK, Japan, US, France, Canada and Germany, found:
| Finding | Number |
|---|---|
| CISOs who see unsanctioned AI use | 68% |
| Confident they can identify all AI agents | 47% |
| Centrally control what AI agents can access | 46% |
| Concerned about excessive AI access | 81% |
IBM's Cost of a Data Breach Report 2025 adds the cost side: 13% of organizations reported breaches involving AI models or applications. Of those that were compromised, 97% did not have AI access controls in place. One in five organizations reported a breach they attributed to shadow AI, at a cost of $670,000 more than the global average of $4.44 million. And 63% of breached organizations either lacked an AI governance policy or were still developing one.
Gartner predicts that by 2030 more than 40% of enterprises will experience security or compliance incidents linked to unauthorized shadow AI. That timeline is generous. From what we see in the field, it's already happening.
What does shadow AI actually expose?
Three things, and all of them are worse than what shadow IT exposed. Shadow IT put an unmanaged SaaS on the network. Shadow AI puts your code, your credentials and your internal logic onto the open internet.
Credentials at scale
GitGuardian's State of Secrets Sprawl 2026 report found 28.65 million new secrets on public GitHub in 2025 — a 34% increase over the year before. AI-assisted commits leak secrets at a rate of 3.2%, more than double the 1.5% baseline for non-AI commits. AI service secrets specifically — API keys for OpenAI, Anthropic, Google AI and similar providers — jumped 81% to 1,275,105. And 24,008 secrets were found in MCP configuration files, of which 2,117 were still valid.
The retention problem makes it worse. GitGuardian found that more than 64% of secrets that were valid in 2022 were still valid in January 2026. Deleting a secret from the code doesn't revoke it. The credential works until someone rotates it, and most organizations don't.
Code outside the perimeter
This is what we call the Shadow Code pattern, and we've published the full case on Cylent Labs. At a global B2B payments platform, a senior product leader uploaded four internal codebases to a personal public GitHub account — to give their AI coding assistant enough context to understand the system. Inside that code was a live SQL injection vulnerability scored at CVSS 8.8.
The organization's security perimeter ended at a personal GitHub account it didn't know existed. No scanner, no SIEM and no ASM tool would have found it. The time from uploading the code to a working exploit in our hands: 10.1 seconds, limited only by how long it takes to run a query.
Samsung's experience is the public version of this pattern. In May 2023, Bloomberg reported that Samsung banned generative AI internally after engineers uploaded proprietary source code to ChatGPT on three separate occasions. That was 2023, before AI coding assistants had MCP integration, before agents could read entire repositories for context, before vibe coding was a daily workflow.
Vibe-coded applications with no security review
Matt Palmer documented CVE-2025-48757 in Lovable, a popular AI code-generation platform. Across 1,645 analyzed projects, he found 303 exposed API endpoints in 170 projects — about 10.3%. The exposed data included names, phone numbers, API keys and payment details. These are applications built in minutes by people who are not developers, deployed without a single security review.
This is what I mean when I say vibe coding is the attack surface of 2026. Letting people build applications with no controls isn't innovation. It's a security incident that hasn't been detected yet.
Why don't traditional controls work?
Because they're designed for code that goes through a pipeline, not code that skips every gate. A standard SSDLC — design review, code review, static analysis, dynamic testing, deployment gate — assumes the code goes through the pipeline. Vibe-coded applications don't. They're built outside the repository, deployed outside CI/CD, and often run from personal accounts or platforms the security team has never heard of.
DLP tools catch files leaving the network. They don't catch an employee who opens Claude Code, feeds it an internal codebase for context, and pushes the output to a personal repo. The data didn't "leave" in any way the DLP recognizes. It was copied as part of a creative workflow the employee considers normal and productive.
And Okta — or any SSO provider — gives a false sense of coverage. SSO covers what's behind it. It doesn't cover API keys, personal access tokens, MCP server credentials, or the AI service key that someone put in a .env file and committed to a public repository. Ron's line on this: Okta tells you who walked through the front door. It doesn't tell you who has a copy of the key.
What we see from the outside
The same pattern, in different flavors. In our continuous external red teaming engagements, shadow AI findings now appear in nearly every scope:
Four internal codebases on a personal public GitHub account, pushed for AI context. A live SQLi inside. The operator's gate — the point where a human confirms it's real — took seconds. A sandbox delta of 10.1 seconds between "company name in" and "critical exploit confirmed." Full details on Cylent Labs.
At an identity-verification vendor, I asked their internal AI tool — within a sanctioned exercise — where the organization's secrets were stored. It directed me to a Slack thread containing a cleartext NPM publish token. That token pushes code to packages downloaded hundreds of thousands of times a week. The AI did exactly what it was built to do. Nobody had asked it that question before.
GitGuardian found 24,008 secrets in MCP config files on public GitHub, 2,117 of them valid. These are the configuration files for the AI tool integrations your employees use daily. Each valid credential is a direct path into whatever system the MCP server connects to.
None of these require a sophisticated attacker. Each one is sitting on the public internet. An AI agent swarm that starts from a company name would find any of them in the first pass.
This week
- Search GitHub for your organization name, your product names, and your employees' names. Check personal accounts, not just the org. Look at what's public.
- Audit MCP configuration files and AI tool config across developer machines. What credentials are stored there, and are they in
.gitignore? - Check whether any vibe-coded or AI-generated applications are running on production domains, subdomains or personal hosting accounts. Ask non-engineering teams.
- Review your AI governance policy. If the answer is "we don't have one yet," that's your answer — and you're in the majority (63%, per IBM).
- Ask your internal AI tools the question: "where are our secrets?" See what comes back.
- Rotate every credential you find. Remember: deleting it from the code is not rotating it. More than 64% of secrets from 2022 were still valid in 2026.
FAQ
What is shadow AI?
The use of AI tools by employees without visibility, approval or governance from the security team. It ranges from pasting code into ChatGPT to building full applications with AI coding assistants and deploying them from personal accounts.
How is shadow AI different from shadow IT?
Shadow IT introduced unmanaged assets — a SaaS subscription, a personal device. Shadow AI actively processes and copies your code, data and credentials to external systems at scale. It's not just a new tool on the network; it's a pipeline that moves your intellectual property and secrets outward.
How common is shadow AI?
68% of CISOs see unsanctioned AI use (Okta, 2026). 78% of AI users bring their own tools to work (Microsoft, 2024). 69% of cybersecurity leaders suspect prohibited GenAI use (Gartner, 2025).
What is vibe coding?
Building software with AI coding assistants — writing a prompt, getting working code, and deploying it. The term describes the workflow where non-developers (or developers cutting corners) ship code that skips design review, code review and security testing entirely.
Can DLP prevent shadow AI leaks?
Traditional DLP catches data leaving through known channels. It does not catch an employee feeding code to an AI assistant as context, or pushing AI-generated output to a personal repository. New controls — AI-aware monitoring, repository scanning, and continuous external testing — are needed alongside DLP.
The bottom line
Shadow AI isn't an emerging risk. It's an active one. The numbers are unambiguous: 68% of CISOs see it, one in five breached organizations attribute the breach to it, and AI-assisted code leaks secrets at double the baseline rate.
The perimeter of your organization no longer ends at your network or your cloud. It ends at the personal GitHub account of your most productive engineer, the MCP config file of your newest hire, and the vibe-coded dashboard your CEO built over the weekend. If nobody is testing that perimeter, nobody knows where it is.
My question: what would your internal AI assistant return if someone asked it where your organization's secrets are stored?
Sources
- Okta, Global CISO Insights 2026 (July 29, 2026, 306 CISOs, data finalized June 2026 with Apprize360)
- IBM, Cost of a Data Breach Report 2025 (July 30, 2025)
- Gartner, press release on shadow AI (November 21, 2025, via syndicated copy; 302 cybersecurity leaders, Mar–May 2025)
- Microsoft, Work Trend Index 2024 (May 8, 2024, ~31,000 workers in 31 markets)
- GitGuardian, State of Secrets Sprawl 2026 (2026)
- Matt Palmer, CVE-2025-48757 (May 29, 2025, Lovable, 303 endpoints across 170 projects)
- Samsung / Bloomberg, Samsung bans generative AI (May 2023)
- Cylent, Shadow Code — personal repo, four codebases, SQLi CVSS 8.8, 10.1s sandbox delta