Understanding Shadow IT in the Age of AI

This report describes the emerging risk of "shadow AI"—employees using unapproved AI services or local models—leading to data exposure, credential theft, and model supply-chain attacks; it cites examples like stolen ChatGPT credentials, malicious payloads embedded in models, and compromised dependency chains, and recommends mitigations including workforce training, approved application lists, continuous network/API monitoring, security assessments, and a zero-trust approach.