Understanding Shadow IT in the Age of AI

This advisory explains the concept of 'shadow AI' (unauthorized AI use in enterprises), details risks including data leakage, credential theft (noting infostealers stealing ChatGPT credentials), model-level malware and poisoned training data, and compromised dependencies, and provides mitigation guidance—employee education, approved-app management, network/API monitoring, security assessments, and a zero-trust approach.