Shadow AI: How Employees Are Quietly Leaking Secrets to LLMs

The biggest AI risk in most companies isn't a sophisticated attacker. It's a well-meaning employee pasting something sensitive into a chat box. This is Shadow AI — unmanaged, unsanctioned AI use — and it is already the source of real, documented data leaks.

It has already happened — repeatedly

• Samsung source-code leak: Engineers pasted confidential source code and internal notes into ChatGPT to debug and summarize. Once data leaves for a third-party model, you can't pull it back — Samsung responded by restricting internal use of public AI tools.
• Wall Street bans: Major banks including JPMorgan and Goldman Sachs restricted employee use of ChatGPT after discovering staff were sharing sensitive information with it. When you can't rule out that customer or market data was exposed, the default becomes prohibition.
• Slack AI exfiltration: Security researchers showed that hidden instructions placed in a message could trick Slack's AI assistant into surfacing data from a private channel to an attacker — a textbook indirect prompt injection turning a helpful assistant into a leak.

Surveys across 2024–2026 consistently find that a large share of employees admit to pasting proprietary code, customer data, or internal documents into public AI tools. The exact percentage varies by study; the direction does not.

Why "just ban it" fails

Blanket bans don't remove the demand for AI — they push it onto personal devices and accounts where you have zero visibility. The goal isn't to stop people using AI; it's to give them a sanctioned path that is safe by default.

The gateway model: visibility without prohibition

A zero-trust AI gateway sits between your apps (and people) and the model providers, so every call is governed in one place:

1. Redact before it leaves: PII and secrets — names, emails, card numbers, keys — are tokenized or redacted in-path, before the prompt reaches the provider, and re-hydrated in the response. The model never sees the raw value.
2. Keep data on your account (BYOK): With Bring Your Own Key, inference runs on your provider account and prompt/response bodies aren't stored by default — so you aren't handing full text to yet another vendor.
3. See everything, provably: Every request is written to a hash-chained, tamper-evident audit trail — which model, which app, what was redacted — so "we don't know what left the building" stops being true.
4. Catch the injection: Inbound prompts are normalized and screened for injection patterns, so a poisoned document or message is far less likely to turn your assistant against you.

The takeaway

Shadow AI is a visibility problem before it is a security problem. Put a governed gateway in the path and pasting a customer record into an AI tool becomes a redacted, logged, policy-checked event instead of an invisible leak. That's how you say "yes" to AI without saying "yes" to the breach.