Shadow AI, the unsanctioned use of consumer AI tools on corporate devices, has become one of the fastest-growing data-leak and initial-access vectors of 2026. The 2026 Verizon Data Breach Investigations Report found 45% of employees now use AI tools on corporate devices, up from 15% a year earlier, and named shadow AI a top insider threat. Netskope’s 2026 Cloud and Threat Report found 47% of workplace generative-AI users access it through personal accounts. IBM data shows roughly one in five organisations has already suffered a breach linked to shadow AI, at an average cost around $4.63 million. The exposure is not hypothetical: it is credentials and prompts sitting in infostealer logs today.
The reason this matters for anyone tracking ransomware and credential theft is the intersection. A personal ChatGPT, Claude, or Gemini account signed in on a work laptop is a session cookie like any other, and infostealers already vacuum those up by default. When the log sells, the buyer inherits not just the account but the entire history of what an employee pasted into it: source code, customer data, internal strategy, credentials. This piece maps how shadow AI feeds the stealer-log economy, what the data shows, and how to close the gap.
What is shadow AI?
Shadow AI is the use of AI tools that an organisation has not sanctioned, provisioned, or secured, typically consumer chatbots and AI browser extensions accessed through personal accounts. It is the AI-era descendant of shadow IT, and it spreads the same way: an employee finds a tool that makes their job faster, starts using it, and tells no one. The difference is what flows through it. Where shadow IT might expose a file-sharing link, shadow AI ingests whatever the employee types, which is often the most sensitive material they handle.
The 2026 Verizon DBIR analysed 858,440 data-loss-prevention events involving AI tools and found source code was the most common data type uploaded, by a wide margin, followed by images, structured data, and research documentation. Netskope’s telemetry puts the average enterprise at around 223 AI-related data-policy violations per month, with the number of users committing them roughly doubling year over year. This is the raw material of a breach, being generated continuously, mostly invisibly.
How does shadow AI end up in stealer logs?
Through the same pipeline as every other credential. An infostealer such as Lumma, Vidar, or StealC compromises an endpoint and exfiltrates saved browser passwords, autofill data, and, crucially, active session cookies. If an employee is logged into a personal AI account in that browser, the cookie goes with everything else. We covered why cookies are the prize in our analysis of session-cookie theft bypassing MFA: the cookie represents an already-authenticated session, so the attacker skips the password and the second factor entirely.
The AI account is a higher-value target than a typical web login for two reasons. First, chat history is a standing archive of sensitive input, so access to the account is access to months of pasted secrets. Second, personal accounts sit outside the enterprise’s identity controls, so there is no corporate SSO to revoke, no conditional-access policy, and often no logging the security team can see. When we examined the stolen-session problem around the Fable 5 and Mythos 5 access restrictions, tens of thousands of stolen AI-tool sessions were already circulating in infostealer logs. Shadow AI widens that pool with every unsanctioned login.
Why personal accounts make it worse
The 47% figure from Netskope is the heart of the problem. A sanctioned enterprise AI deployment can enforce SSO, data-loss-prevention, retention limits, and audit logging. A personal account on the same machine has none of that. The organisation cannot see what was shared, cannot revoke the session centrally, and cannot prove what left the building after an incident. IBM’s finding that high-shadow-AI organisations pay around $670,000 more per breach than low-shadow-AI ones reflects exactly this blindness: the cost is not just the leak, it is the inability to scope it.
There is also a compounding effect with agentic tools. As shadow AI shifts from chatbots to AI browsers and agents with high-privilege access, an exposed account is no longer just a data-leak risk. It can act. An attacker with a stolen agent session may be able to trigger actions inside connected systems, a risk we mapped in our work on the MCP attack surface and agentic AI threats. Shadow AI is quietly turning ordinary account-takeover into something closer to remote operation.
What should security teams do?
Start by measuring, not banning. Blanket bans push shadow AI further underground and cost you the visibility you need. Netskope and Verizon both find that usage is already near-universal, so the realistic goal is to route it through sanctioned tooling. Provide an enterprise AI option good enough that staff prefer it, enforce SSO and DLP on that option, and monitor egress for the consumer endpoints staff would otherwise default to. The Verizon DLP telemetry shows source code is the top leaked asset, so instrument your code repositories and developer endpoints first.
On the credential side, treat AI-account exposure as a monitored event. Continuous dark-web and stealer-log monitoring should include the domains of the AI tools your workforce actually uses, so a leaked session surfaces before it is exploited. Enforce short session lifetimes and token binding where the platform supports it, and make personal-account use on managed devices a policy you can technically detect, not just a line in a handbook. The through-line with every stealer-log story we cover is the same: the credential was leaking for weeks before anyone noticed. Shadow AI just adds a richer credential to steal.
Frequently asked questions
What is shadow AI?
Shadow AI is the use of AI tools an organisation has not sanctioned or secured, usually consumer chatbots and AI browser extensions accessed through personal accounts. It is the AI-era version of shadow IT, but it ingests far more sensitive data.
How common is shadow AI in 2026?
The 2026 Verizon DBIR found 45% of employees use AI tools on corporate devices, up from 15% a year earlier, and Netskope found 47% of workplace AI users rely on personal accounts. IBM reports about one in five organisations has had a shadow-AI-linked breach.
How does shadow AI relate to stealer logs?
Personal AI accounts signed in on work devices leave session cookies in the browser. Infostealers exfiltrate those cookies along with saved passwords, so a stolen log can hand an attacker an authenticated AI session and its full chat history.
Why are personal AI accounts riskier than enterprise ones?
Personal accounts sit outside corporate identity controls, so there is no SSO to revoke, no DLP, and no audit trail. That blindness is why IBM finds high-shadow-AI organisations pay around $670,000 more per breach.
Should companies ban AI tools to stop shadow AI?
Banning tends to drive usage underground and remove visibility. Most guidance favours offering a sanctioned enterprise AI option with SSO and DLP, then monitoring egress and stealer-log exposure for the consumer tools staff would otherwise use.
What data leaks most through shadow AI?
The 2026 Verizon DBIR found source code was the most common data type uploaded to AI tools by a wide margin, followed by images, structured data, and research documentation.
Sources and further reading
- Kiteworks: Verizon DBIR 2026, shadow AI now a top insider threat
- Infosecurity Magazine: Personal LLM accounts drive shadow AI data-leak risks
- Vectra AI: Shadow AI risks, costs, and governance
- Ransomnews: Stealer logs bypassing MFA in 2026
- Ransomnews: Fable 5 and Mythos 5: the US-only gate threat actors will beat