Shadow AI Trends: 80% of Employee AI Tools Evade IT Oversight

Post Views: 12

A recent analysis reveals that 80% of AI tools deployed by employees operate without IT department oversight, exacerbating security risks as AI vulnerability rates rise.

The findings, derived from platform telemetry data, an examination of 500 Model Context Protocol (MCP) servers on npm, and a review of AI-related vulnerabilities in the National Vulnerability Database (NVD), highlight the growing challenge of unregulated AI adoption.

The study indicates that while 79% of software-as-a-service (SaaS) applications are authorized within organizations, the majority of AI tools—such as browser extensions and MCP servers—remain unmanaged. This discrepancy underscores the rapid expansion of “shadow AI,” which is outpacing traditional shadow IT trends.

Small and mid-sized enterprises are particularly affected, with an average of 414 unsanctioned AI tools per 1,000 employees.

The risks associated with shadow AI have evolved beyond simple data leaks. Modern AI agents and MCP servers now possess capabilities that allow them to execute shell commands, access local files, and establish network connections.

Analysis of 500 MCP servers found that 50% enable shell command execution, 82% support local file operations, and 73% permit outbound network traffic. When combined, these features create significant security vulnerabilities.

Approximately 40% of MCP servers offer all three capabilities simultaneously, while 62% provide file and network access, creating pathways for data exfiltration. Additionally, 26% of MCP servers expose network endpoints, with half of these requiring no authentication by default. This lack of access controls leaves critical systems vulnerable to remote exploitation.

The report also highlights a surge in AI-specific vulnerabilities. Since 2023, 637 AI-related flaws have been documented in the NVD, with 525 disclosed in the past 18 months. Of these, 111 received critical CVSS scores (9 or higher), averaging one high-severity vulnerability every few days.

A previous study found that 12% of skills available on the OpenClaw marketplace ClawHub were malicious, underscoring the need for proactive risk management.

Organizations are advised to conduct thorough audits of AI tools, mapping their capabilities, permissions, and access scopes. Excessive or unused permissions should be revoked, and tools sourced from online marketplaces must be rigorously vetted.

The proliferation of unregulated AI tools and the increasing complexity of their functionalities demand immediate attention. As threat actors exploit these gaps, enterprises must implement robust governance frameworks to mitigate the risks associated with shadow AI.