Moviwa
Back to home
Shadow AI: five ways your data leaves, and only one has a culprit

Shadow AI: five ways your data leaves, and only one has a culprit

When you picture a shadow AI data leak, you picture something specific: someone pasting a contract into ChatGPT from a personal account.

That is the easy case. There is a person, a moment and a decision. You can train against it, ban it, audit it.

The trouble is that it now accounts for only part of the exposure. The other four routes have no identifiable person, no moment and, above all, no decision. The data leaves on its own, continuously, long after somebody clicked a button that looked harmless.

We have already covered the shadow AI numbers: 80% of workforces use it and most organizations have no visibility. This article is about the other half of the question: where exactly it gets out.

Route 1: the paste (the only one with an owner)

The 2023 Samsung case is still the canonical example. Engineers pasted proprietary source code into a chatbot within days of an internal ban being lifted.

It is the most visible route and the easiest one to put on a slide. It is also the only one where there is somebody to train.

And that is the underlying problem: almost every corporate AI policy ever written is designed against this route. Against the only one people can see.

Route 2: the attachment

Nobody uploads a paragraph. They upload the whole document.

You ask for a summary of a report's conclusions and drag in the 80-page PDF. You want one column analyzed and you upload the entire spreadsheet, along with the other fourteen tabs, the hidden rows somebody filtered back in 2023, and the tracked-changes comments.

The data you needed to share was three figures. The data you shared was the file.

Teramind's Shadow AI Report 2026 finds that sensitive prompt content is concentrating in legal and financial material (up to 31%) and source code (around 10%), rather than generic text. And most of that arrives as an attachment: PDFs, decks, spreadsheets, logs and entire repositories.

Route 3: the extension with permissions

This is the one that changes the nature of the problem.

An AI browser extension runs inside the user's session, with their permissions, over their network. It can read page content, form fields and session cookies, not by exploiting a vulnerability but by design, as the Cloud Security Alliance research note on AI browser extensions documents. A grammar checker with access to page content may be reading CRM records, email threads and financial dashboards in real time.

Two details almost nobody checks:

  • OAuth tokens granted to these extensions persist indefinitely until somebody revokes them by hand. They survive password changes and device changes. An employee who left a year ago may have left a channel open.
  • From your perimeter security's point of view, none of this looks like an attack. No lateral movement, no privilege escalation, no anomalous processes. Just ordinary HTTPS traffic from a legitimate user.

According to Netskope's Cloud and Threat Report 2026, as reported by Adaptive Security, 47% of generative AI users reach these tools through personal accounts, and the average company racks up 223 AI-related data policy violations per month.

Route 4: the connector and the agent

The 2026 version of the problem.

We are no longer talking about chatbots but about integrations: connectors into Drive, copilots embedded in the SaaS you already used, MCP servers exposing internal APIs, agents holding persistent OAuth access. Gartner estimates that 40% of enterprise applications will ship task-specific agents by the end of 2026, up from under 5% in 2025, per Vectra AI's roundup.

The difference from pasting is qualitative. An employee grants access once, in two clicks, on a permissions screen nobody reads. From then on the data flow is automatic and continuous. It does not show up in your application inventory, your CASB cannot see it, and there is no event to review.

On top of that, these agents carry AI-native risks of their own: a prompt injection can turn an agent with access to your mailbox into an exfiltration channel operated from outside.

Route 5: the shared link

The last route is the most mundane, which is exactly why it gets underestimated.

Somebody generates a public link to show a colleague a conversation. That link is a URL reachable from the internet. No authentication, no expiry and, in some cases, indexable by search engines: precisely what happened when Claude conversations turned up in Google without any security breach at all.

There was no attack. There was a share button.

The leak does not end when the prompt leaves

Here is the point that turns a one-off incident into prolonged exposure.

The data does not just leave: it stays.

On consumer plans, deletion reaches less far than it appears. OpenAI removes deleted conversations within 30 days, subject to legal and security exceptions. Anthropic applies the same window, but where a user opts into model improvement it keeps de-identified data for up to five years, and up to two years for anything its classifiers flag under the usage policy. That jump from thirty days to five years, and how easily it gets switched on by accident, is something we covered when Anthropic changed its default.

Then there is human review, which almost nobody factors in. Google states that Gemini conversations reviewed by people are retained for up to three years and are not deleted when you delete your activity. Its own warning leaves no room for interpretation:

"Please don't enter confidential information that you wouldn't want a reviewer to see."

And above all of that sits litigation. In May 2025 a preservation order in the New York Times case required OpenAI to retain logs its normal policy would have deleted, and that April to September 2025 data remains in storage. Your retention policy holds until a court decides otherwise.

An employee on a personal account is not having a conversation. They are transferring data to a third party, with no contract, no international transfer safeguards and no entry in your record of processing activities.

A correction on the legal timeline

When we published our shadow AI article, the critical date was 2 August 2026. That has changed, and it is worth stating precisely.

The Digital Omnibus on AI, approved by the European Parliament on 16 June 2026 and by the Council on 29 June, pushed Annex III high-risk obligations back to 2 December 2027, and Annex I embedded-system obligations to 2 August 2028. Article 50 transparency obligations, by contrast, still apply from 2 August 2026.

But the delay changes nothing that matters for shadow AI, for a simple reason: the real exposure in a data leak is not the AI Act. It is the GDPR, and that has been in force since 2018.

When a client file lands in a personal account, the breach is of Article 28, and it does not wait until December 2027. The subscription invoice is the documentary evidence.

What to do now

One step, this week: audit OAuth tokens and installed extensions, not applications.

Your inventory of approved apps will tell you nothing new. The list of extensions with read permission over page content, and the list of third parties granted access to your Google Workspace or Microsoft 365, will. That is where routes 3 and 4 live.

With that list in front of you:

  1. Revoke access for people who have left and for tools nobody remembers approving.
  2. Provide an approved alternative before banning anything. The evidence is consistent: where a working official option exists, unauthorized use drops by as much as 89%; where there is only a ban, it goes underground.
  3. Register your AI systems in your record of processing activities.
  4. Add a technical layer before data is sent, because the first three all depend on people complying.

Where Moviwa fits

All five routes share one thing: the data leaves in clear text. That is the single point where you can intervene without depending on forty people doing the right thing.

When somebody hits "Send" in ChatGPT, Claude or Gemini, Moviwa analyzes the text in milliseconds and, if it detects identifying data, offers to replace it with reversible tokens (prefixed TK_) or cancel the send. The model still gets the context; the name, the ID number and the bank account stay inside. When the response comes back, the token is restored.

Against what you have just read, it solves three things:

  • It covers the attachment, not just the prompt. Analysis extends to PDFs, spreadsheets, source code and images, which is where the volume goes out.
  • It gives you the evidence. The dashboard documents, in aggregate and by data type, what was detected and blocked: direct material for your ROPA and for an ISO 42001 or EU AI Act audit.
  • It does not surveil anyone. Moviwa does not log conversations or monitor individual behaviour. It acts only when sensitive data is in transit, and the final decision belongs to the person.

Sources

All accessed 9 August 2026.

Shadow AI usage and exposure

Technical surface: extensions and the browser

Retention and human review

The providers' own documentation, which is what counts when you have to justify a decision to a supervisory authority.

Regulatory framework

Earlier articles

Start with the easy part: you can try the same detection technology right now, with no signup, using our free anonymizer. It runs in your browser and no data leaves your machine.

Then the rest. Request a demo and in 15 minutes you will see the real state of your organization: what is going out, through which route, and with what exposure. No card, no commitment.

This article reflects the state of the regulatory framework as at 9 August 2026, including adoption of the Digital Omnibus on AI. It is informational and does not constitute legal advice: always check the current official documentation before making compliance decisions.