Forget Data Leakage: Shadow AI's Real Threat Is Access Control

**Executive summary:** The report warns that modern AI integrations request persistent OAuth permissions which, if the AI vendor is compromised (as in the Klue incident), allow attackers to access and exfiltrate downstream customer data without phishing or user interaction, and it recommends visibility-first controls such as OAuth token inventory, scope classification, revocation of stale grants, rate-limiting, and vendor security assessments.