A five day campaign from Exec x AI. 7 to 11 September 2026.
Say No to Shadow AI
Five confessions from people who were only trying to get the job done.
MTWTF
The problem is not your people
At Exec x AI we are focussing on the dangers of shadow AI and what it costs companies in fixes, fines and repairs to their IT systems.
The weakest link is the employee. Not through malice. Employees try to do the right thing and end up using shadow AI because their employer has not sanctioned a safer alternative.
The result?
- Data breach
- Loss of confidentiality
- Trade secret exposure
- Privacy breach
- Regulatory penalties
- Customer claims
- Privilege and confidentiality waiver
- Incorrect legal advice
- Litigation exposure
- IP leakage
- Vulnerable code
- Malicious dependencies
- Security compromise
- Unauthorised actions
- Mass data access and exfiltration
- Account compromise
- Materially wrong decisions
- Financial misstatement
- Market and regulatory exposure
- Discrimination claims
- Employment litigation
- Regulatory breach
- Loss of IP advantage
- Patent and trade secret complications
- Bad contracts
- Incorrect reports
- Erroneous decisions
- Operational failures
- Supply chain compromise
- Credential theft
- Data exfiltration
The ban that did not work
Somewhere in your organisation this morning, someone competent pasted something confidential into a chat window.
They were not being reckless. They were being quick.
The deadline was real. The approved tool was not. So they used what was already on their phone. It worked. They will do it again tomorrow.
That is shadow AI. It is rarely sabotage. It is usually initiative.
Nobody in your company set out to leak anything.
The number your CFO will recognise
IBM put a price on it. In the 2025 Cost of a Data Breach report, breaches involving shadow AI carried an extra USD 670,000 against the global average. The global average itself was USD 4.44 million, down 9 percent on the previous year.
Sixty three percent of surveyed organisations reported no AI governance policies in place. Of those that suffered an AI related security incident, 97 percent said they lacked proper AI access controls.
Freshworks surveyed 1,000 IT decision makers at United States mid market companies and published in April 2026. Eighty six percent reported at least one negative incident tied to unapproved AI in the previous year. Twenty three percent reported more than three.
Then the awkward finding. Seventy nine percent of those same leaders said the employees using unapproved tools are more productive. Thirty five percent called the gains substantial.
Shadow AI is not a technology failure. It is a procurement failure.
What the damage actually looks like
The harm rarely arrives labelled as an AI incident. It arrives as something else.
Legal finds out when privilege is contested. Finance finds out when a figure is restated. Engineering finds out when a dependency nobody approved starts calling home. HR finds out when a rejected candidate asks how the decision was reached, and nobody can answer.
By then the tool has been in use for a long time. Reco's usage research puts the average life of an unsanctioned AI application inside an organisation at more than 400 days.
Shadow AI added USD 670,000 to the average cost of a breach.
Five confessions
All five are live. A decision nobody could account for. An agent holding plain text keys on a finance laptop. A lawyer putting client work into a free app. Unpublished results outside the company for three weeks. An HR integration nobody approved.
Each card carries the control that closes it.
Privilege is built on confidentiality. A consumer chatbot is not.
You cannot ban your way out of a productivity gap.
What to do about it
Start with discovery. Find what is already in use through network and SaaS telemetry, expense claims and browser extension inventories. An amnesty week will surface more than any scan.
Then classify. Decide which data classes may never leave the organisation, and write that down in language a non specialist can apply without ringing the legal team.
Then sanction. Give people a licensed alternative for the tasks they are actually doing. If the approved route is slower than the unapproved one, nothing has been fixed.
Then control. Scope tokens, enforce least privilege, and put an approval gate in front of any connection between two systems.
Then evidence. Log prompts, outputs and approvals so a decision can be reconstructed months later.
Then train on the specific failure rather than on AI in general.
The tool your staff chose is now your data processor.
Every unapproved tool is a contract nobody signed.
You cannot investigate what was never logged.
Your fastest employee is writing your AI policy.
What to do about it
Start with the register. List every AI tool in use and name the legal entity behind each one. Where you cannot name it, that is the finding.
Then the terms. Read what the provider says about training, retention and sub processors, and record the date you read it, because those terms change without telling you.
Then the flow. Establish which categories of data reach each tool and which jurisdiction they come to rest in.
Then the exit. Agree in advance how you would remove your data and how you would prove it had gone.
Then the question you will be asked. Who decided, on what basis, and when. Design the log to answer that question and nothing else.
Then capture the prompt, the output, the model version and the person who approved the action, and keep them together as one record.
Then set retention against your longest limitation period rather than your smallest storage bill.
Then test it. Take a decision from last month and try to reconstruct it. The gap you find is the gap someone else will find later.
Then measure the speed gap. Time the approved route against the unapproved one for the same task. If the sanctioned path is slower, your policy is a suggestion.
Then close it where the volume sits. Fix the few tasks that account for most of the unapproved use before you write a single page.
Then make the request route visible and quick, and publish how long it took last month.
Then reward disclosure. An employee who tells you what they are using is doing your discovery for you.
Speak to an Exec x AI consultant about what is already running inside your organisation.
One page. Run it yourself before you speak to anyone.
Shadow AI exposure checklist
We use your details to send you the exposure checklist and to answer any question you raise about it.
References
Verified against the publisher's own page
Shadow AI added an extra USD 670,000 to the global average breach cost.
The global average cost of a data breach was USD 4.44 million, down 9 percent on the previous year.
Sixty three percent reported no AI governance policies in place.
Of breached organisations that experienced an AI related security incident, 97 percent said they lacked proper AI access controls.
Eighty six percent of IT leaders reported at least one negative incident tied to unapproved AI in the past year. Twenty three percent reported more than three.
Seventy nine percent said employees using unapproved tools are more productive, including 35 percent who described the gains as substantial.
21,639 instances of a widely used open source AI agent were reachable from the open internet on 31 January 2026, a twenty one fold rise inside a week.
1.5 million authentication tokens, 35,000 email addresses and private agent messages were exposed through a database left without row level security, discovered 31 January 2026.
Close to 900 malicious extensions were identified in one public agent registry, around a fifth of all packages published there.
A critical flaw scored 8.8 allowed a malicious web page to capture an agent's authentication token, disable sandboxing and achieve remote code execution on the host. Patched 30 January 2026.
A New York federal court held in February 2026 that documents prepared with a consumer AI tool were not protected by attorney client privilege, because the tool's terms permitted the provider to retain, review and disclose the material.
A single trial court ruling. The law in this area is unsettled.
2,022 court decisions involving hallucinated citations or invented authority were tracked worldwide as at 5 September 2026, including 1,379 in the United States and 69 in the United Kingdom.
A running count. The figure is the total tracked on the date stated and rises as new decisions are added.
Anthropic states that inputs and outputs from its commercial products, such as Claude for Work and the Anthropic API, are not used to train its models by default.
The provider's own published position, as at the date verified. Exec x AI has not audited the practice behind it.
Italy's data protection authority, the Garante, imposed an emergency ban on the processing of Italian users' personal data by a widely used AI chatbot provider, reported as the first emergency ban on an AI chatbot under the GDPR, on grounds including undisclosed storage locations for personal data and failure to cooperate with the authority.
OpenAI states that ChatGPT Enterprise, Business and API data is not used to train its models by default, with SOC 2 Type 2 audits, AES 256 encryption at rest, TLS 1.2 and above in transit, and administrator controlled retention.
The provider's own published position, as at the date verified. Exec x AI has not audited the practice behind it.
Freshworks surveyed United States mid market IT decision makers. Treat the figures as indicative for EMEA and APAC, not as measured there.
Vendor research, published figures
Unsanctioned AI applications persist inside organisations for more than 400 days on average.
Companies with 11 to 50 employees averaged 269 shadow AI tools per 1,000 employees.
Government device bans covering Australia, Canada, Denmark, Belgium, the Netherlands and the Czech Republic.
South Korea's Personal Information Protection Commission found that user prompts had been transferred to Chinese companies without proper consent.
Reported by the source named, not independently verified
These accounts were supplied by the campaign owner and were assembled in an AI chat conversation. A conversation is a route to a source, not a source.
Each underlying publication is a vendor marketing article carrying an anonymous executive account. Searches on 6 September 2026 did not independently locate the specific articles or corroborate the accounts.
Reported by the source named, not independently verified
A chief compliance officer at a mid sized Saudi financial institution reported that a company wide ban on a public AI chatbot had not stopped the credit risk team using personal accounts, and that client financial data had reached the chatbot vendor's systems.
Reported by the source named, not independently verified
A head of security at a mid market company reported that, before any AI feature existed in the product, customer information had already been placed into several AI tools adopted independently by employees.
"customer data sitting in several AI tools"
Reported by the source named, not independently verified
A security review described a CISO who estimated three or four unapproved AI tools in the organisation. The investigation found nineteen, fourteen of which had been in active use for more than six months.
"The actual number was nineteen."
Reported by the source named, not independently verified
A former biotechnology executive told Business Insider that he had knowingly worked around his employer's AI restrictions, judging the risk of falling behind a competitor to outweigh the risk of data leaving the company.
"the chance of you being eclipsed by a Chinese peer"