Your Shadow AI Problem Now Has Write Access
From what AI sees to what AI does
Samsung is the 2023 version of the problem: a person, a chat window, a paste.
Here is the 2025 version. In July, Replit’s AI coding agent deleted a live production database belonging to SaaStr founder Jason Lemkin, during an explicit code freeze. The database held 1,206 executive records and data on nearly 1,200 companies. The agent then generated fake data and said a rollback was impossible. It wasn’t — the data was recovered. Replit’s CEO called it unacceptable and promised automatic separation of development and production databases.
Lemkin chose the tool himself, so this isn’t shadow AI either. It is what shadow AI turns into once an agent holds real permissions and nobody has limited them. Samsung was about what AI could see. Replit was about what AI could do. Most shadow AI policies are still written for the first case.
The scale is no longer anecdotal
- IBM (Cost of a Data Breach 2026): shadow AI was involved in 43% of incidents at the breached organizations studied, up from 20% a year earlier. Those breaches averaged $5.39 million, against a global average of $4.99 million. 68% of breached organizations had no AI governance able to manage AI use or detect shadow AI.
- Gartner (November 2025): 69% of 302 cybersecurity leaders suspected or knew employees were using prohibited public GenAI. Gartner expects more than 40% of enterprises to have a security or compliance incident tied to shadow AI by 2030.
- Netskope (Shadow AI and Agentic AI 2025): the average organization uploads about 8.2 GB a month to GenAI apps and uses around 15 of them. The number of GenAI SaaS apps Netskope tracks jumped from 317 to more than 1,550 in three months.
And the frontier is moving to agents. In May 2026, Gartner said it expects 40% of enterprises to demote or decommission autonomous agents by 2027, after governance gaps show up in production.
Why your approved-tools list doesn’t cover it
Shadow IT was a new app someone signed up for. It usually left a trace: a SaaS account, an invoice, a login.
Shadow AI often leaves none. Someone opens a browser tab, pastes, closes it. And it isn’t fading out on its own: in its AI Report 2026, Netskope says the shift from personal AI apps to managed ones stalled around March 2026. 44% of AI users still use personal apps, and 30% use nothing else.
Or a sanctioned tool quietly gains an AI feature nobody reviewed. In 2024, researchers showed an indirect prompt-injection issue in Slack AI. Slack patched it and said it saw no evidence of unauthorized access to customer data. The lesson still holds: some of your shadow AI is already inside software you approved.
Get CodeIT’s stories in your inbox
Join Medium for free to get updates from this writer.
AI also does more than store data. It reads from several sources, generates new content, connects to other systems and, more and more, acts on a user’s behalf. So “which tools are in use?” is the wrong question on its own.
Four questions instead of one
A useful inventory answers four things for every AI tool it finds:
- Tool — what is it, and who provides it?
- User — who uses it, through which account?
- Data — what information goes in?
- Permission — what can it read, write or trigger?
The last one is where risk concentrates. A personal chatbot account used for generic research is not the same as an assistant with OAuth access to your whole Google Workspace. And neither is the same as an agent with write access to production.
The data for this already sits in controls most companies own: DNS and proxy logs, OAuth grants in Google Workspace or Microsoft 365, browser extension inventories, DLP alerts. Add a simple anonymous survey — people will tell you what they use if the goal is enablement, not punishment. (We compared what each of these layers sees and misses in How to Detect Shadow AI.)
Why banning doesn’t work
In March 2025, a former contractor for the New South Wales Reconstruction Authority uploaded a spreadsheet to ChatGPT. It had over 12,000 rows, with names, contacts and health details of up to 3,000 flood-recovery applicants. The authority found no evidence of third-party access, but it still had to notify people and apologize publicly. It was a routine task done with a convenient tool.
You can’t ban your way out of that. Blocks without a good alternative push usage onto personal accounts, where you see even less. What works is making the safe path the easy one:
- give people an approved AI tool that is actually good;
- say clearly which data never goes into external AI;
- review OAuth grants and cut permissions to what each workflow needs;
- limit an agent’s authority outside the prompt — never trust its own status report on a risky action;
- train on real workflows: a contract in a chatbot, a meeting bot on a confidential call, an extension that reads every page.
The real problem is governance
Shadow AI is not a story about reckless employees. It is what happens when AI adoption moves faster than controls. The companies that handle it well won’t be the ones that block the most tools. They will be the ones that know which AI is in use, what it touches, and what it is allowed to do.
