You have firewalls, DLP, endpoint protection, and a 40-page data classification policy. Then an engineer pastes 2,000 lines of proprietary source code into a public LLM to debug it faster. A marketer uploads last quarter’s unreleased financial forecast to summarize it. HR drops candidate CVs with personal data into an AI tool to write job descriptions.
It takes five seconds. It bypasses every control you paid for.
This is not a hypothetical scenario. This is the new face of data leakage, and it’s happening in almost every company.
It’s called Shadow AI, the unvetted, unmanaged, and unmonitored use of public generative AI tools with corporate data.
Why Do Smart Employees Do Risky Things
Employees are not being malicious; they are being productive.
Public LLMs like ChatGPT, Claude, Gemini, Perplexity and hundreds of niche AI writing, coding, and meeting-summary tools are incredibly good at their jobs. They help employees meet deadlines and some of their work faster. The problem is the friction gap. Your approved, secure enterprise AI, if you have one, is often slower, less capable, or harder to access than the public tool they already have open in another tab.
When security policy conflicts with productivity, productivity almost always wins unless you make the secure path the easy path.
Also, most employees genuinely do not understand what happens when they hit “enter”.
They assume it’s like a Google search: private, ephemeral, and forgotten.
But, it is not.
What Counts as “Sensitive” Is Broader Than You Think
When incidents are audited, employees rarely think they leaked anything sensitive.
But LLMs turn seemingly benign data into sensitive exposure.
I. Intellectual Property and Source Code
Code, algorithms, product designs, architecture diagrams, internal research. Once pasted into a public model, you may have lost trade secret protection and violated your own open-source licenses.
II. Business Confidential Information
Unreleased financial results, M&A plans, pricing strategies, customer lists, supplier contracts, roadmaps, OKRs, board decks. This is gold for competitors and for market manipulation.
III. Personal and Regulated Data
This is where it becomes a legal incident. CVs, employee performance reviews, customer support tickets, patient records, and sales call transcripts containing names, email addresses, phone numbers, and other identifiers all involve personal data. Under regulations such as GDPR, CCPA, and HIPAA, processing this data without an appropriate legal basis or other required safeguards can create serious legal and compliance risks.
IV. Credentials and Security Data
We regularly see API keys, passwords, private keys, AWS credentials, and internal log files pasted for troubleshooting. These are not just leaked; they are now potentially in a training dataset and searchable by prompt injection attacks.
The Real Risks Most Don’t Include in the AI Policy
I. Irreversible Data Leakage and Model Training
Most free and consumer-tier public LLMs explicitly state in their terms that your inputs may be used to train future models. Even when vendors offer an opt-out, you cannot verify it. Your data becomes part of a black box model hosted by a third party. You cannot delete it, you cannot audit who has accessed it, and you cannot prevent it from resurfacing in an answer to another user months later. Researchers have already demonstrated extracting training data from LLMs through clever prompting.
With enterprise LLM features like memory and personalization enabled, the risk becomes even greater. The model doesn’t just process the data it can retain it, learn from it, and use it to personalize future interactions.
II. Compliance Failure by Default
If you operate in the EU, the moment an employee pastes personal data of an EU citizen into an unvetted US-based public LLM without a Data Processing Agreement, you have likely breached GDPR Article 28. The same applies to HIPAA, PCI-DSS, and sectoral regulations.
You cannot prove purpose limitation, data minimization, storage limitation, or security of processing. In an audit, you have no record of processing activities, no data transfer impact assessment, and no way to fulfil a data subject’s right to erasure because you do not control the processor. Regulators are starting to ask specifically about this. Italy’s independent data protection authority Garante’s temporary ban of ChatGPT in 2023 was just the opening shot.
III. Loss of Attorney-Client Privilege and Contract Breach
Pasting outside counsel advice, litigation strategy, or a contract under negotiation into a public LLM can waive attorney-client privilege. It can also breach confidentiality clauses and NDAs with your customers. If your customer contract says you will not disclose their data to third parties without consent, and your employee pastes their data into an AI tool, you have breached that contract. You are liable.
IV. Shadow AI Supply Chain
There are over 10,000 AI-powered SaaS tools launched in the last 18 months for meeting notes, email writing, sales prospecting, and image generation. Many lack SOC 2 certification, enterprise DPAs, or clear visibility into 1.
V. Prompt Injection and Indirect Data Exfiltration
The risk is bidirectional. Employees pasting sensitive data into an LLM can be tricked by malicious actors. An attacker can hide instructions in a webpage, PDF, or email that says “summarize this document”. When the employee pastes it into the LLM, the hidden prompt can instruct the model to exfiltrate the previous conversation containing sensitive data. This is not science fiction; it is a documented OWASP Top 10 for LLM Applications vulnerability.
VI. Model Hallucination Leading to Business Decisions
When employees feed proprietary data into an unvetted model to get analysis, the model’s hallucinations are now anchored in your real data, making them much more believable. A finance analyst who asks an LLM to forecast based on leaked real sales data might get a confident but entirely fabricated forecast and present it to leadership.
What To Do Instead of Just Blocking Everything
Blocking LLM at the firewall does not work. People use their phones, personal laptops, and mobile data. A purely restrictive approach drives the behaviour further underground.
What you need a three-layer approach:
I. Make the Secure Option the Best Option
Deploy an enterprise-grade AI gateway or private instance. Microsoft Copilot with commercial data protection, ChatGPT Enterprise, Claude for Work, or an Azure OpenAI private deployment where data is not used for training, is encrypted at rest, and has a signed DPA. If your secure tool is as good and as easy as the public one, 90% of the problem disappears.
II. Create Visibility, Not Just Control
Deploy CASB and DLP solutions that can detect and classify prompts containing sensitive data patterns like API keys, PII, and source code. Tools like Microsoft Purview, Netskope, and Palo Alto can flag or redact sensitive content before it leaves your network. You need to know the scale of the problem first.
III. Train for Reality, Not Theory
Stop showing generic AI awareness slides. Show real, anonymized examples from your own logs.
“Here is how source code leaked last month. Here is how HR data was pasted.”
Make it visceral. Teach three simple rules:
- Never paste Confidential or Restricted data into any public AI.
- Check the data classification.
- Use only the approved AI portal.
Conclusion
The question is no longer whether your employees are using public AI tools with corporate data.
They are.
The question is whether you will know about it before your data shows up in a competitor’s model output, a regulator’s inquiry, or a breach notification.
Your perimeter used to be your firewall.
Now your perimeter is every employee with a browser tab open.
It is time to make moves to secure it.