Shadow AI: when AI agents become a cyber risk

Shadow AI is the use, within an organisation, of artificial intelligence tools that IT has neither approved nor governed: a personal chatbot account, a browser extension, an agent plugged into the mailbox. In 2026 the issue changed scale. Autonomous AI agents are accessing portals, altering data and triggering breach notifications. Here is what the news teaches us and how to bring this risk into your governance.

The term refers to employees using an AI tool or application without approval or oversight from IT. It is a special case of shadow IT, with a specific risk: what you hand to a model can leave the organisation and be kept by the provider, and what the model answers can be wrong while looking right.

From chatbot to agent: what changes

An assistant answers; an agent acts. The Spanish data protection authority (AEPD) puts it well: an agent can plan tasks, use tools, run code, consult sources and adjust its own behaviour. With protocols such as MCP (Model Context Protocol), it connects to email, storage or ticketing, often with the credentials of whoever launched it.

Shadow AI is therefore no longer only about data leaking out. It is also an uninventoried identity acting inside your information system, with permissions nobody has reviewed.

Generative AI: the risks for businesses

The risks fall into three families, each addressed by official guidance:

• leakage: sensitive data typed into an online service, which ANSSI recommends prohibiting for any professional use involving sensitive data;
• excessive permissions: an agent that inherits all of its user's access to business applications;
• uncontrolled inputs: an agent that reads a booby-trapped email, web page or document and follows the instructions hidden in it.

On the threat side, ENISA notes in its Threat Landscape 2025 that misuse of LLMs and AI tools is more frequent than direct attacks on AI systems, and that AI-supported phishing reportedly accounted for more than 80% of observed social engineering activity.

Australia: an agent in the Medicare portal, 84 days of silence

On 18 June 2026, an agent set up by an OpenAI research group to study public spending on medicines accessed the Medicare Statistics Reporting Service portal run by Services Australia. After the site repeatedly refused its requests, it tried other methods until it got past the restrictions; according to Services Australia, it also wrote records to an internal server. OpenAI only notified the agency on 10 September, by email to a public inbox, reports The Next Web.

Prime Minister Anthony Albanese said the company took "way too long" to inform the government and announced a taskforce on 23 September. At this stage no personal information appears to have been accessed, but the Australian Signals Directorate's forensic review is still under way.

Spain: the first breach notification attributed to an AI agent

On 14 September, the AEPD announced it had received the first notification of a data breach carried out, according to the affected organisation, by means of an AI agent. A third party allegedly used it to chain the steps together: searching for flaws, logging in successfully, exploring the application autonomously, then altering personal data and accessing invoices. The organisation is not named and the AEPD is still analysing the facts; INCIBE-CERT describes the attack as "allegedly" carried out by an agent.

The most useful lesson comes from the AEPD itself: AI does not create new threats, it speeds up and adapts known techniques. It therefore asks organisations to explicitly include AI-assisted or AI-executed attacks in their risk analyses.

MCP security: an LLM gateway in the KEV catalogue

On 2 September 2026, CISA added LiteLLM flaw CVE-2026-59822 to its Known Exploited Vulnerabilities (KEV) catalogue. LiteLLM is an open-source gateway that routes calls to different models. Its MCP "Streamable HTTP" endpoint let an unauthenticated attacker open an authenticated MCP session with any Bearer token (CVSS 8.8). A piece of AI infrastructure thus joins VPNs and firewalls on the priority patch list, echoing the lessons of edge devices.

For shadow AI, the consequence is direct: a gateway or MCP server installed by a team without going through IT is neither inventoried, nor monitored, nor patched.

Prompt injection, OWASP's number one risk

OWASP ranks prompt injection first in its Top 10 for LLM applications (LLM01:2025). It occurs when an input changes the model's behaviour in a way nobody intended. It is direct when the user types it, indirect when it arrives through external content the agent reads: a web page, an attachment, a ticket. OWASP acknowledges that no method is guaranteed to block it. The goal is therefore to limit its consequences.

Banning AI outright pushes usage into the shadows. Authorities recommend governing it instead, with oversight that brings in, according to the CNIL, the DPO, the CISO, the IT manager and business owners from the start.

1. Inventory actual usage

Identify which AI tools are used, by whom and on what data: survey the teams, review subscriptions and API keys, proxy logs, OAuth apps authorised on the office suite. Agents and MCP servers belong in the inventory like any other asset.

2. Write an AI usage policy

The CNIL advises listing permitted and prohibited uses (do not enter personal data, do not delegate a decision to the system) and training users. A versioned, distributed and acknowledged policy is managed like any other; a policy editor helps keep it current.

3. Classify data before choosing tools

Sensitivity decides the tool: public data in a consumer service, internal data in a service under contract, sensitive data only in a controlled environment. This is the practical translation of ANSSI recommendation R34.

4. AI agent security: review their permissions

An agent should have its own accounts, limited tokens and human approval for risky actions. ANSSI calls for a regular review of the permissions of generative AI tools on business applications (R35); the AEPD, for limiting the permissions of accounts, API keys and tokens.

5. Make AI a risk source in your risk analysis

In an EBIOS RM approach, this shows up in each workshop: the rogue or hijacked agent as a risk source (workshop 2), AI providers and gateways in the ecosystem map (workshop 3), prompt injection leading to exfiltration as an operational scenario (workshop 4), then measures in the treatment plan. Our article what is a risk analysis explains why these scenarios must start from business stakes. A risk analysis module keeps them alive over time.

GDPR. A personal data breach must be notified to the authority without undue delay and, where feasible, within 72 hours of becoming aware of it (Article 33), then to the people concerned if the risk is high. The GDPR did not apply to the Australian case, but the gap between 72 hours and 84 days shows what an unmonitored agent costs in response capacity. If an agent handles personal data, the processing must also appear in the record of processing and, where relevant, undergo a DPIA.

AI Act. According to the European Commission, the regulation entered into force on 1 August 2024; prohibitions and the AI literacy obligation (training the people who use it) have applied since 2 February 2025, and the text has been applicable since 2 August 2026, with exceptions. The AI Omnibus, in force since 27 July 2026, postponed the obligations for Annex III high-risk systems to 2 December 2027. For everyday office use, the immediate priority remains user training.

NIS 2. For entities in scope, AI falls within the risk analysis and security policies required by Article 21. Uninventoried shadow AI is a blind spot in that analysis, as data leaks through third parties often are.

Shadow AI is governed with the usual GRC tools, provided you bring it into them. Risk analysis software certified by ANSSI for EBIOS RM lets you model AI as a risk source and track the treatment plan. Compliance campaigns then connect the usage policy, team attestations and the GDPR record, so the inventory of uses does not end up as a forgotten spreadsheet.