What is shadow AI?

Shadow AI is the use of AI tools inside an organization without approval or oversight from security and IT. In engineering it includes coding assistants that send proprietary code to unvetted models, creating data and compliance risk.

Shadow AI vs shadow IT

Shadow IT is the older idea: staff using software or services that IT has not approved. Shadow AI is a specific, fast-growing case of it.

• Shadow IT covers any unapproved tool, from a file-sharing app to a server.
• Shadow AI covers unapproved AI tools, including chat assistants and coding agents.
• Shadow AI carries an extra risk: data sent to the tool can train a model the company does not control.

Where it appears in engineering

Engineering is one of the most common places for shadow AI, because the tools are useful and easy to adopt.

• Coding assistants that send proprietary source to a model the company has not vetted.
• Chat tools used to debug code by pasting in internal logic.
• Editor plugins and browser extensions that call external models.
• Personal accounts used for work tasks, outside any company agreement.

The risks

• Data leakage: proprietary code or secrets sent to a third-party model can be stored or used for training.
• License exposure: generated code may carry license terms the team has not reviewed.
• Compliance gaps: data handling can break regulations the company is bound by.
• No audit trail: when usage is hidden, the security team cannot assess what left the building.

Secrets pasted into an unvetted tool are especially costly, which is why secrets management belongs in the same conversation.

How to govern it without blocking productivity

Banning AI tools tends to push usage further into the shadows. The better path gives engineers approved options and clear rules.

• Provide vetted tools, so there is a sanctioned way to get the benefit.
• Set clear policy on what data may be sent and to which models.
• Choose tools that keep source private and keep audit context out of long-term storage.

Treat AI tooling as part of supply chain security, since each tool is an external dependency with access to code. Pairing approved tools with autonomous code governance keeps oversight in place as adoption grows.