• Work data, work AI. Use approved tools signed in with your work account. Personal accounts play by consumer rules.
• Less is more. Give AI the minimum it needs: totals and trends, not names and ID numbers.
• Check before you upload. Hidden tabs, comments, and “I thought I deleted that” are how real leaks happen.

Previously, the defense’s AI found thousands of serious software flaws, helped analysts catch threats faster, and got fenced in so it can’t overstep. The rules that keep company AI in check only work if you’re using company AI. Which brings us to Shadow AI.

It’s Tuesday morning. You’ve got a spreadsheet with 2,000 customer records, an executive who wants a report by lunch, and approximately 37 other things competing for your attention.

Fortunately, you have an idea.

You open the free AI website you used last weekend to plan a road trip, upload the spreadsheet, and ask it to find trends, write a summary, and produce some attractive charts.

Thirty seconds later, you have a report that would have taken two hours. Magnificent. Technology is wonderful. You briefly consider asking it to write your self-assessment, too.

There’s just one small problem.

You may have just handed 2,000 people’s personal details to a company your employer has never vetted, never signed a contract with, and has no easy way to ask for them back.

Oops.

Not because you’re careless, and not because AI is dangerous. You were trying to do your job efficiently, which is rather the point of having technology. The problem is that AI quietly changed what “sharing” means, and most of us haven’t had a reason to think about it yet.

So let’s think about it. Briefly, and with a minimum of lecturing.

This isn’t hypothetical. Ask the bank that did exactly this.

In May 2026, CB Financial Services, the parent company of Pennsylvania’s Community Bank, made a public disclosure to the US Securities and Exchange Commission (SEC). That’s the kind of formal filing companies usually reserve for hackers and ransomware.

There was no hacker.

A law firm that tracks these filings called it the first one of its kind blamed on unapproved AI use. The good news in the story: the bank caught it quickly, contacted the AI company, and had the file deleted. The bank says it got there before the data could be used to train the vendor’s AI. Speed made that possible. Hold that thought.

And this isn’t one unlucky bank. Verizon’s 2026 Data Breach Investigations Report, one of the security industry’s biggest annual studies of how data goes missing, found that regular AI use on work devices tripled in a single year, from 15% of employees to 45%. About two-thirds of those people were logged in with personal accounts rather than work ones. Unapproved AI is now the third most common way well-meaning employees accidentally move data somewhere it shouldn’t go.

Nobody in those numbers was trying to cause trouble. They were all having a Tuesday.

Where does your information actually go?

Tools like ChatGPT, Claude, Gemini, and Microsoft Copilot are examples of generative AI: software that creates new content (writing, summaries, charts, code) based on your instructions. Those instructions are called prompts. A prompt might be a quick question, a request to draft an email, or a 40-page financial report with the note, “Make this understandable to normal human beings.”

Most of these tools are cloud-based, which means the real work happens on the AI company’s computers, not yours. Whatever you type or upload travels to them.

What happens next depends on the tool, the type of account, your settings, and whatever contract (if any) your employer has with that provider. Some services keep conversations for a while. Some personal, consumer-grade services may use conversations for model training, the process an AI uses to learn from examples. In plain terms: your content could help shape future versions of the product.

To be clear, uploading something doesn’t automatically make it public, and it doesn’t automatically get used for training. But once it’s sitting on someone else’s computers, what happens to it is up to them, not your company.

Personal AI vs. company AI: same robot, different rules

Think about the difference between a file in your personal Gmail and the same file in your company’s official file storage. Both are “in the cloud.” Only one is covered by your company’s contracts and security controls, with a team that can find it, protect it, and delete it when needed.

AI works the same way. Enterprise (business) versions of AI tools typically come with a contract limiting what the provider can do with company data, plus administrative controls and records of activity. For example, Microsoft says Copilot Chat does not use your prompts to train its AI when you’re signed in with a work account, and it shows a small shield icon at the top of the chat to signal those protections are on. Anthropic makes a similar commitment for the business versions of Claude.

The personal version of the exact same tool, signed in with your personal email, plays by consumer rules.

An enterprise account isn’t a magical privacy force field, though. A tool letting you upload something doesn’t mean you’re authorized to upload it. Your refrigerator will let you store a live squirrel. That doesn’t make it a good idea.

Meet Shadow AI

Security people have a name for AI tools used outside the company’s approved set: Shadow AI. It sounds like a science-fiction villain. In practice, it’s a well-meaning colleague with a deadline.

Someone finds a free AI notetaker that joins video calls. Someone else installs a browser extension (a small add-on for Chrome or Edge) that promises to summarize every email. Another tries an AI document website because the charts are prettier.

Nobody is trying to hurt the company. But every new tool is another outside company holding your company’s information, each with its own privacy policy, its own security (or lack of it), and its own opinion about how long to keep things.

That free meeting notetaker? It may receive everyone’s names, the entire conversation, pricing discussions, and the recording itself, none of which anyone in the meeting expected to leave the company. Multiply that by a dozen tools, and suddenly nobody can answer a simple question: where is the company’s data?

“But I didn’t give it anything confidential!”

Let’s test that. Imagine asking an AI tool to draft a reply to a customer who wants a refund. You include their name, the amount, the circumstances, and a few details about their order.

Seems harmless. Except you’ve just shared personally identifiable information (PII): information that identifies a person, or could identify them when combined with other details. Names, email and street addresses, phone numbers, ID numbers, and certain transaction details can all qualify.

Other information that needs special care includes:

• Financial reports, pricing, contract terms, compensation, and acquisition plans.
• Customer lists, contracts, and internal strategy.
• Employee performance, personnel, and medical information.
• Passwords, security codes, and other credentials.
• Unannounced speakers, sessions, and anything else that hasn’t been made public.

And removing names isn’t always enough. Changing “John Smith” to “Customer 123” doesn’t help much if the file still includes his company, job title, hometown, and extraordinarily distinctive purchase history.

The next surprise: AI that can reach into your other apps

Many AI tools now offer connectors: links that let the AI read from (and sometimes act in) your other apps, such as email, calendar, and file storage. They’re genuinely useful. Instead of copying and pasting, the assistant fetches what it needs.

But when you click “Allow,” you’re handing the tool a token, a digital key that lets it act on your behalf without needing your password. That key may open far more than the one document you meant to summarize, and some keys also let the tool send messages or change files.

A meeting summarizer doesn’t need permission to delete files or send email as you. If an AI tool asks for everything, that’s your cue to pause. And just because an app appears in a familiar app store doesn’t mean your company has approved it.

So how can IT security promote secure AI use and not become the Department of No?

Good news: we don’t have to choose between AI and security. Six habits cover almost everything.

1. Use approved AI tools, signed in with your work account. Not sure what’s approved? Ask your IT or security team. It’s a 30-second question, not a confession.

2. Share only what the task needs. A chart needs monthly totals, not 2,000 names and email addresses.

3. Clean the file, then check it again. Remove or replace names, emails, and ID numbers. Look for hidden tabs, comments, tracked changes, and extra sheets. The bank employee thought the sensitive data was gone. It wasn’t.

4. Keep secrets secret. Passwords, API keys (codes that let one piece of software log into another), and multi-factor or recovery codes never belong in a prompt.

5. Read the permission screen. Before connecting AI to email, calendars, or files, confirm the tool is approved and that what it’s asking for matches what it actually does.

6. Found a great new tool? Bring it to your security team. Security teams would much rather review a promising tool up front than discover it after the fact. If it’s good, everyone gets to use it safely.

And if you’ve already shared something you shouldn’t have, tell your IT or security team right away: which tool, roughly when, and what kind of information. Don’t re-send the sensitive material to “show” them. Remember the bank: a fast report is what let them get the file deleted.

Back to Tuesday

Let’s rewind. Same spreadsheet, same executive, same 37 other things.

This time you open the company-approved AI tool, signed in with your work account, and give it a copy of the spreadsheet with monthly sales totals, product categories, and regional breakdowns. No names. No emails. You double-check the hidden tabs, because you’re thorough like that.

The AI builds the report. The executive gets the charts. You get two hours of your day back. And 2,000 customers never find out how close they came to a starring role in somebody else’s dataset. Same productivity. None of the drama.

AI is an extraordinary workplace tool. The trick isn’t avoiding it; it’s knowing which information belongs where. After all, we wouldn’t hand a stranger the customer list because they promised to make us a lovely pie chart. Let’s not do it online, either.

Stay tuned as our Cybersecurity Awareness series continues with a look at prompt injection: what happens when your AI assistant starts taking orders from a document instead of from you.