What Is Shadow AI? How to Find It on Your Endpoints

Shadow IT was an online app adopted without asking IT: a file-sharing service, a project management tool. Shadow AI goes further in two ways. The data is no longer just stored somewhere else; a model reads and rewrites it, and, depending on the terms of service, may keep it to improve itself. And the tool no longer just answers: a desktop assistant or an agent can open files, run a command or install a component to get its task done.

The first is conversational: internal data pasted into a public chatbot, on a personal account, under terms nobody read. The second comes through extensions and integrations: a browser or email add-on that can read everything on screen.

The third is the newest and the least visible: assistants that rely on tool servers, for example in the MCP format, and launch programs locally. A single line of configuration is enough to download and run a package on the fly, with no installer and no confirmation dialog.

An antivirus looks for what is malicious. A tool server launched by an assistant is not necessarily malicious: it is a legitimate program, running with the user's privileges, at the request of a tool the user configured themselves. Software inventory lists what is installed, not what is launched on the fly from a package registry. And network filtering sees a connection to an AI service, without knowing what was sent or what the assistant did next on the machine.

If personal data goes to a third-party service, the GDPR applies: you need a lawful basis, a data processing agreement with the provider and, where relevant, safeguards for transfers outside the EU. Since February 2, 2025, the EU AI Act has also required companies that use AI systems to ensure their staff have sufficient AI literacy (Article 4); knowing which tools are allowed, and on what terms, is part of that.

Outside the EU, the same questions usually come back through sector rules, for health or financial data for instance, and through client confidentiality clauses.

1. Ask. A short, anonymous survey reveals real usage better than any tool, as long as it does not sound like a witch hunt.
2. Check the network logs. Connections to AI service domains show who uses them, and how often.
3. Inventory the endpoints. Installed extensions, desktop assistants, and the configuration files of tool servers.
4. Decide. Write an AI policy that lists the approved tools, the alternatives the company provides, and the data that never goes into them. Banning without offering anything does not stop the usage; it moves it where you can no longer see it.

That is what MAIVAR, our endpoint snapshot tool, is for. It takes a complete snapshot of a Windows workstation in twenty seconds, without admin rights and without writing anything to the machine, including what an AI assistant can launch on the user's behalf. The snapshot is sealed and signed, so you can prove later what was present on a given date.

Its results are measured and published: on a real workstation, 318 raw memory indicators brought down to zero false positives, and thirteen canaries planted on purpose, including an MCP server, a hook and hidden instructions, all detected. It is a starting point: you can only govern what you have first seen.

Above all, shadow AI tells you one thing: your teams found real value in these tools. The right response keeps that value and removes the risk: chosen tools, protected data, and agents whose rights are limited and whose actions are logged. For agents that act inside your systems, our AEGIS Control lab explores a control layer that refuses any action until the agent's identity, mission and authorization can be verified.