Fastero Dev TeamSomeone on your team needs an answer by four o'clock. They export the customer list or last quarter's orders to a spreadsheet, paste it into ChatGPT on their personal account and ask for a summary. It works, they look good, and the company's data now sits in a consumer AI service under consumer terms. Nobody decided that; it just happened. That is shadow AI.
The short answer: shadow AI is the use of AI tools that the company hasn't approved and can't see. IBM defines it as "the unsanctioned use of any artificial intelligence (AI) tool or application by employees or end users without the formal approval or oversight of the information technology (IT) department." It is common: in Verizon's 2026 data, 67% of people using AI on work devices did so through non-corporate accounts. It is rarely malicious; people use it because it saves them time. Banning it tends to push it out of sight. What works is giving people an approved tool that's as easy as pasting, on a business plan that doesn't train on your data, connected to the data with permissions instead of exports.
Fastero
Connect your database. Ask questions. Get dashboards.
Postgres, BigQuery, Snowflake, and 10+ sources — live-connected, AI-powered, no dashboard builder learning curve.
Try free →What shadow AI looks like in a normal company
- A sales manager pastes a CRM export into ChatGPT to find which accounts are slipping.
- Someone in finance uploads the month's invoices to a free AI app to draft the board summary.
- An analyst uses a browser extension that summarises whatever page is open, including the internal dashboard.
- A developer pastes a failing query, with customer rows in the error, into a personal AI account.
Each one is reasonable on its own. Together they mean company data is spread across personal accounts on services your company has no contract with, and nobody can say what went where.
Shadow AI is a branch of shadow IT, the old problem of staff using apps IT never approved. The difference is the direction of travel: a shadow spreadsheet app holds data you put in on purpose, while an AI tool is fed whole exports in the moment, often containing customer details, and its answers can't be checked or repeated later.
How common it is: the numbers, with their small print
Shadow AI statistics are some of the most misquoted on the internet. Here are the ones that hold up, with what each actually measured:
| Figure | What it measured | Source |
|---|---|---|
| 67% use non-corporate AI accounts | Share of users on corporate devices reaching AI services through personal accounts; down from 72% the year before | Verizon Data Breach Investigations Report, 2026 |
| 47% use personal AI apps | Share of generative AI users on personal apps, down from 78%, while managed accounts rose from 25% to 62% | Netskope Cloud and Threat Report, January 2026 |
| 78% bring their own AI tools | Share of AI users (not all workers) bringing their own tools to work; 80% at small and mid-sized companies | Microsoft and LinkedIn Work Trend Index, May 2024 |
| 1 in 5 organisations | Share of breached organisations that reported a breach due to shadow AI | IBM Cost of a Data Breach, July 2025 |
| $670,000 | Extra average breach cost for organisations with high shadow AI use | IBM Cost of a Data Breach, July 2025 |
| 90% vs 40% | Workers at over 90% of companies used personal AI tools for work; only 40% of companies had bought an official subscription | MIT NANDA, The GenAI Divide, July 2025 |
Three corrections worth knowing before you quote any of these:
- The 78% is from 2024, and its base is people who already use AI. Microsoft's 2026 Work Trend Index has no equivalent figure.
- Verizon's press release says shadow AI "tripled to 45%". Its report doesn't. The report's 45% is everyone who is "regular users of AI (authorized or not)". The shadow-specific figure is the 67%.
- IBM's 63% of organisations without an AI governance policy counts only breached organisations, including those still writing a policy, not all organisations.
What gets pasted matters as much as how often. In Netskope's data, the three kinds of data most involved in generative AI policy violations were "source code (42%), regulated data (32%), and intellectual property (16%)."
Two real cases
Samsung, spring 2023. Shortly after Samsung's chip division allowed ChatGPT, engineers pasted equipment source code, yield-analysis code and a transcribed meeting into it. Bloomberg reported the memo that followed: "Earlier in April, Samsung engineers accidentally leaked internal source code by uploading it to ChatGPT, according to the memo." Samsung banned generative AI on company devices while it built internal tools.
An Australian state agency, 2025. This is the closer match to someone pasting an export. New South Wales' Reconstruction Authority announced that a former contractor uploaded personal information to ChatGPT: "The data shared was a Microsoft Excel spreadsheet with 10 columns and more than 12,000 rows of information." Up to 3,000 people may have been affected, and the disclosure came months after the upload.
What AI apps do with pasted data in 2026
The same AI vendor treats data very differently on a personal plan and a business plan, and staff on personal accounts get the personal rules, not the company's.
| Personal plans | Business plans | |
|---|---|---|
| ChatGPT | Free, Plus and Pro: "data sharing is enabled by default" for model training; you can switch it off under Settings › Data controls. Rating a reply can still send that conversation for training | Business, Enterprise, Edu and the API: not used for training by default |
| Claude | Since August 2025, Free, Pro and Max chats are used for training only when the setting is on, and then kept for five years; otherwise 30 days | Team, Enterprise and the API are excluded from those terms and not used for training by default |
| Gemini | Human reviewers read some chats, and reviewed chats are kept for up to three years. Google's own advice: "Please don’t enter confidential information that you wouldn’t want a reviewer to see or Google to use to improve our services, including machine-learning technologies." | Workspace content isn't human-reviewed or used to train models outside your organisation without permission |
Deleting a chat isn't always the end of it either. OpenAI was under a court order in the New York Times case to keep consumer ChatGPT chats; that obligation ended on 26 September 2025, but chats from April to September 2025 are still held, and in January 2026 a judge upheld an order to hand over a sample of 20 million de-identified chat logs.
Connect any database. Ask in plain English.
Connect database →Why banning it rarely works
Samsung's first response was a ban, and many companies did the same. The sources that track this closely recommend the opposite: find out what people use, approve the good tools, and block the rest. Netskope's advice is to start with "a policy to allow reputable apps currently in use while blocking all others", and its data shows that move happening: personal app use fell from 78% to 47% in a year as companies moved people onto managed accounts.
MIT's researchers go further: "Forward-thinking organizations are beginning to bridge this gap by learning from shadow usage and analyzing which personal tools deliver value before procuring enterprise alternatives." The shadow tool is telling you what people need. If the approved option is slower or worse, people will go back to pasting.
A shadow AI policy that fits on one page
You don't need a security team to get most of the benefit. For a company of 10 to 200 people:
- Find out what's in use. Ask people which AI tools they use for work and for what. Expect to be surprised, and don't punish honesty.
- Pick one approved assistant on a business plan. ChatGPT Business or Enterprise, Claude Team or Enterprise, or Gemini in Workspace. Business plans don't train on your content by default, and you control who has access.
- Write down three rules. What may never go into any AI tool (passwords, keys, health or payment card data); what may only go into the approved one (customer and financial data); and that personal AI accounts are not for company data.
- Stop the export habit at the source. Most pasting starts with "export to CSV". If the AI can query the data directly, with the person's own permissions, the export never happens.
- Check every few months. Ask again, and look at what the approved tool is used for.
Give people a better tool than the shadow one
The pasted export is the weak point: it copies everything, carries no permissions, and the answer can't be checked or repeated. The safer pattern is to connect the AI to the data, once, with the same limits the person already has.
That is how Claude works with Fastero. You connect your databases, Stripe, HubSpot, Xero, Google Sheets or an uploaded file to a Fastero workspace once; the credentials stay in Fastero and never reach the chat. Each person then adds Fastero to Claude from its connector directory and signs in as themselves:
- Claude sees only what that person may see. The connector acts as the person who signed in and can never do more than their role in the workspace allows. A key is checked against their role on every call, and revoking it ends access at once.
- Questions become queries, not uploads. Claude runs read-only SQL; a statement that could change data is refused. It reads at most 500 rows or about 100 KB per query, so a whole table can't land in the conversation by accident.
- Answers agree with your reports. Claude reads the metric definitions your team has saved, so "revenue" means the same in the chat as on the dashboard.
- There's a record. Every call through the connector is logged with who made it, which key and which tool.
- Results stay where the team can use them. A chart Claude draws can be saved to a dashboard colleagues open with their own login, with no AI account needed. Viewers are free.
Fastero's connector in Claude, with a permission setting for each tool. Taken on a test account, 5 November 2026.
One thing a connector can't change: what Claude does with the results it reads depends on your Claude plan. Use a Team or Enterprise plan for company data, so the conversation falls under business terms.
FAQ
What is shadow AI?
The use of AI tools at work without the company's approval or knowledge, most often staff pasting company data into personal ChatGPT, Claude or Gemini accounts. It's a branch of shadow IT, focused on AI tools.
Is shadow AI always a security problem?
It's usually well-meant: people use it because it saves time. The risk is what goes in, such as customer or financial data, and that it goes in under consumer terms. In IBM's 2025 study, one in five breached organisations reported a breach caused by shadow AI.
Does ChatGPT train on what I paste?
On Free, Plus and Pro, data sharing for training is on by default, and you can switch it off in Settings › Data controls. On ChatGPT Business, Enterprise, Edu and the API, OpenAI doesn't train on your content by default.
Does Claude train on my chats?
On Free, Pro and Max, only if the training setting is on; chats are then kept for five years, otherwise 30 days. Claude Team, Enterprise and the API are under commercial terms and not used for training by default.
Should we ban ChatGPT at work?
A ban mostly moves use out of sight. Approve one assistant on a business plan, set a few clear rules about data, and make the approved route as easy as pasting.
How do we stop people pasting exports into AI tools?
Remove the reason to export. Connect the AI to the data directly, with each person's own permissions and read-only access, so they can ask the question without copying the data first.
Related reading:
- AI agent governance: why pilots stall
- What is a semantic layer?
- MCP security
- Claude connectors
- ChatGPT vs Claude for data analysis
Sources: IBM: what is shadow AI, IBM Cost of a Data Breach 2025, Verizon 2026 DBIR, Netskope Cloud and Threat Report 2026, Microsoft and LinkedIn Work Trend Index 2024, MIT NANDA: The GenAI Divide, Bloomberg on Samsung (via Yahoo), NSW Reconstruction Authority, OpenAI data controls, OpenAI on the NYT data demands, Anthropic consumer terms update, Gemini Apps privacy hub, Google Workspace generative AI privacy. Checked 5 November 2026.
Try Fastero free — connect your data once and let your team ask Claude questions with their own permissions, instead of pasting exports. No credit card required.