What Shadow AI Is
Shadow AI is any AI tool used for work without the organization knowing about it or approving it: a chat assistant on a personal account, a meeting recorder that joined a call, a browser extension that summarizes pages, or a coding agent on a developer's laptop.
It is shadow IT with one important difference. A shadow file-sharing app holds the files someone chose to put there. A shadow AI tool receives whatever a person pastes in to get help, and people ask AI for help with exactly the material that matters: contracts, client records, financials and source code.
Nobody needs to act in bad faith for shadow AI to spread. AI tools are free to try, take a minute to sign up for, and are genuinely useful. Staff adopt them before IT has an opinion.
Where Shadow AI Hides on Client Devices
- Browser chat apps on personal accounts, the most visible and the most used.
- Desktop AI apps, such as the ChatGPT and Claude apps, which a browser control never sees.
- Command-line and coding tools, such as Claude Code and Codex, that read files and run commands.
- Browser AI extensions that read the page in front of the user, including web apps full of client data.
- AI built into software the client already pays for, from office suites to note-taking and e-signature apps.
- AI apps connected to the client's accounts through Microsoft 365 or Google Workspace sign-in, which keep access to mail and files.
- Local models run with tools such as Ollama or LM Studio, where nothing is inspected on the way out because nothing goes out, and downloaded models can be anything.
- MCP servers that give AI clients access to repositories, databases, CRMs and the file system.
The AI app catalog lists the 230 AI apps ProctoredAI recognizes across these categories, each with its risk and the controls that fit.
What Shadow AI Puts at Risk
- Data leaving without a record. Client records, health and payment data, credentials and confidential documents reach vendors the client has no agreement with.
- Compliance gaps. HIPAA, PCI DSS, GLBA and the GDPR apply whatever tool the data is pasted into. See how AI use maps to each framework.
- Personal accounts holding work. When an employee leaves, the conversations, files and connected access leave with their personal account.
- Access, not just data. Agents and MCP servers act on systems. An unreviewed one is an unreviewed integration.
- No answer when asked. Security questionnaires, auditors and boards now ask which AI tools are in use. Shadow AI means the honest answer is "we don't know".
How to Detect Shadow AI
| Method | Finds | Misses |
|---|---|---|
| Ask staff (surveys) | What people remember and are willing to say | Most of it |
| DNS or firewall logs | AI domains reached from the office network | Remote devices, which product on a shared domain, which account, and any content |
| Identity provider app grants | AI apps connected to Microsoft 365 or Google Workspace accounts | Everything used without that sign-in |
| Browser extension | AI web apps in one managed browser | Desktop apps, command-line tools, other browsers, local models and MCP servers |
| Endpoint agent | Every AI app on the device, the account it is signed in with, installed AI apps, local runtimes and MCP servers | Devices without the agent, and apps that pin their certificates (seen, but not inspected) |
The strongest picture combines an endpoint agent with the identity provider's app grants: the agent shows what runs on devices, and the grants show what was connected to the client's accounts from anywhere, phones included. ProctoredAI does both.
The Two-Week Shadow AI Audit
- Day 1: deploy in observe-only mode. Push the agent from the RMM. Nothing is blocked; every AI app, account and sensitive-data finding is recorded.
- Day 1: connect the identity tenant. List the AI apps that hold Microsoft 365 or Google Workspace access.
- Days 2 to 14: let it run. Two weeks covers month-end work, meetings and the tools people only use occasionally.
- Day 14: build the findings. Which AI apps, how many people, personal or work accounts, what kinds of sensitive data reached which apps, and which AI apps are installed or connected.
- Day 15: walk the client through it. Decide each app: approve, approve with work accounts only, or block. This meeting is where the managed service is sold.
From Found to Governed
Finding shadow AI is the start. Governing it means a status for every app per client, data rules that stop credentials, patient data and sensitive documents before they reach an AI service, an AI Use Policy employees acknowledge, and a monthly report that proves it all held. The MSP AI governance guide covers the full service.
Questions
Is shadow AI the same as shadow IT?
It is shadow IT for AI tools. The difference is what goes into them: people paste in the material they need help with, which is often the most sensitive material they have.
Should we block every AI tool?
Blanket blocks push AI use to personal phones and laptops, where nothing is visible. Most clients do better approving one or two tools with work accounts, blocking risky categories, and stopping sensitive data everywhere.
Can shadow AI be found without decrypting traffic?
Partly. Hostnames show which AI services are reached, and ProctoredAI's discovery of unlisted AI apps works from hostnames alone. Seeing what was sent, which account was used, or which product sits on a shared domain needs inspection, which ProctoredAI does on the device for AI services only.
What about AI on phones?
There is no agent for iPhone or Android, but AI apps connected to the client's Microsoft 365 or Google Workspace accounts show up from any device, phones included.
How are new AI tools found?
Desktop agents report hostnames that look like AI products the catalog does not know yet, at most once a week each. They appear in the console with an alert, ready for a decision.