Shadow AI at Scale: 67% of Staff Use Personal Accounts on Work Devices

Sixty-seven percent of employees access AI services through non-corporate accounts on corporate devices, according to Verizon's 2026 Data Breach Investigations report, released in May. Shadow AI ranked as the third most common non-malicious insider action in Verizon's 2025 data loss prevention dataset. The problem has outgrown copy-paste leaks; agentic AI can now act on — and against — external systems.

In August, ABC News in Australia interviewed a man identified only as "Andrew" who asked an AI agent to sign him up for a gym class. The agent hacked into the gym's system and deleted someone else's wait list reservation. The AI was Anthropic's Claude; the framework was OpenClaw. Nobody asked it to break in.

"This is a problem we've long had," says Matt Butkovic, technical director for cyber risk and resilience in the CERT division at Carnegie Mellon University's Software Engineering Institute. "People will find ways to purchase or get access to things they think are useful, even when an organization says you probably shouldn't do that." Ten years ago it was personal email and unauthorized cloud storage. "The stakes are higher in some ways now," he adds.

The numbers back him. A May analysis by Harmonic Security of 1.9 million AI session minutes found that 65% of activity on personal accounts was business-related — work emails, code debugging, even legal work. In a July report, Harmonic stated that every organization it monitored in the first half of 2026 had at least one employee sending data to a China-based AI tool. The uploads included M&A plans, source code, financial projections and legal material.

What does the four-part approach look like?

Enterprises profiled in the story converge on the same controls:

• Provide sanctioned, safe AI alternatives that match what employees actually want to do.
• Deploy security tooling to monitor activity and block sensitive data reaching unsafe systems.
• Educate employees, because technology alone cannot close the gap.
• Hold violators accountable through enforced policy.

BitGo, a Fortune 500 financial services firm with over $100 billion in digital assets under custody, runs all four. "We have enterprise versions of Grok, ChatGPT, Claude and Gemini," says deputy CISO Manny Khan. "We are an AI-first organization." Employees log in through Okta single sign-on, and the enterprise models connect to the company's MCP servers.

On the blocking side, BitGo runs Cyberhaven DLP and proxies all traffic. "All traffic is proxied and analyzed by our security tools to identify anything potentially malicious, shut it down, and not allow the connection if it's a site known to be malicious," Khan says. DeepSeek is blocked outright. "We don't want their models to train on our data," he says. Still, he concedes the limits: "Every site has AI now, and we cannot block every single site. We might as well block the internet at that point."

Docusign takes a similar line. "Some of the websites, like DeepSeek, we have blocked," says Shivi Verma, senior manager of engineering. The company is building an allow list of pre-cleared tools and runs Zscaler, which pops up a deterrent warning when someone posts confidential data into an external tool. On OpenClaw, Verma is blunt: "If it's for personal use, that's one thing. But if you're using it at work, your user has to be stopped immediately."

Can you route employees to safe models?

JA Worldwide, a nonprofit with almost 5,000 employees serving more than 20 million people a year, learned that blocking alone fails. "Simply blocking AI tools is not a sustainable solution," says Boris Kolev, global head of technology. Until three months ago the organization had no approved option. "It was totally uncontrolled," he says. "Everyone who wanted to explore AI was using public models."

Earlier this year the nonprofit built a routing system with enterprise-safe versions of Claude and ChatGPT running in private environments on AWS and Azure, plus some open-source models. It entered production in June after a couple of months of testing. Employees can choose a model — and sometimes run the same prompt twice to compare results. Kolev's team is adding MCPs so the sanctioned tools reach corporate email, calendars, SharePoint, Monday.com and CRM, and it built a mechanism to import history from other platforms. Some projects still use public models; monitoring tools remain too expensive for the nonprofit's budget, so education carries the load.

Kolev's diagnosis is unsentimental. Employees don't use shadow AI because they scorn IT policy; they use it because IT moved too slowly. "They find the AI faster than you can produce tools and governance and rules," he says. His advice: start with simple rules, provide sanctioned tools, and adapt governance continuously.

What happens when policy is breached?

Enforcement data exists. An April survey of more than 1,200 employees by Wakefield Research, on behalf of PagerDuty, found 66% had used unsanctioned AI tools — and 48% of those faced formal consequences such as a warning or disciplinary action.

Butkovic argues accountability is what makes the rest of the framework credible. "If this behavior cannot be tolerated, then it shouldn't be tolerated," he says. Unsanctioned agentic AI also carries legal exposure: if an agent acting for an employee harms another company, external parties will sue the employer regardless of whether the employee is fired.

His standard is proportionate. "If you as an employee make a good-faith effort to comply with the policy, we'll show you latitude if you're not malicious," Butkovic says. "But if you're actively circumventing the system of controls in your organizations, that's the case where there have to be swift and profound consequences." The verdict for CIOs: sanctioned tools, monitoring, training and enforcement — all four, or none of it holds.