The UK's National Cyber Security Centre (NCSC) has warned that employees using unapproved AI tools can expose corporate data and create security risks that organizations may struggle to detect and manage.
The NCSC blog post, published on September 7, said shadow AI was likely to persist as employees adopted new services faster than organizations could assess them and provide approved alternatives.
The agency cited Microsoft research that found 71% of UK employees had used AI tools not approved by their employer. The NCSC said the research suggested shadow AI use was widespread.
Unapproved AI Tools Create Visibility Gaps
Shadow AI refers to AI technology that falls outside an organization's approved systems and processes and is a form of shadow IT.
"Many people are reaping the benefits of AI in the workplace and are rightly being supported to do so by their employers, but IT security teams should not assume they are seeing the full picture," said David Chismon, NCSC CTO for architecture.
The NCSC said employees who give shadow AI access to company or customer data likely increase the risk of data breaches, intellectual property loss and failure to meet regulatory requirements.
The blog post said the problem could emerge when existing cybersecurity policies failed to meet business needs, encouraging staff to adopt new services before their employer had assessed them.
Read more on shadow AI: One In Four Employees Use Unapproved AI Tools, Research Finds
The NCSC also warned that AI agents could carry critical vulnerabilities, and that an attacker exploiting one could gain the same data, services and privileges the agent legitimately held.
It explained that attackers were highly likely to use agents with looser guardrails to exploit vulnerabilities or misconfigurations elsewhere in corporate IT.
Organizations Urged to Reduce Shadow AI Risks
Employees who transfer sensitive information to consumer AI services are likely reduce their organization's visibility and control over it, the NCSC said, because that information may be stored, retained or used to improve the service.
The agency warned that organizations should focus on reducing rather than eliminating shadow AI, as with shadow IT more broadly. It recommended adopting a positive cybersecurity culture so employees felt able to discuss security issues openly.
"Organizations can't hope to block connections to all possible AI tools, so they need to develop a positive cybersecurity culture with open dialogue about the tools staff might wish to use and to set clear guardrails around what secure use of AI looks like," Chismon said.
The NCSC also pointed to guidance on the careful adoption of agentic AI services, published with international partners.