Shadow AI and AI Assistants: A New Attack Surface for Companies

Shadow AI is employees' use of AI tools outside the company's approval and visibility, usually with personal accounts. Contracts, customer lists, source code and financial tables are uploaded to these tools in good faith and processed outside the organisation's control. On top of that, AI assistants and agents are becoming a new target for attackers. In this article we look at the risks of shadow AI, prompt injection attacks and the steps companies should take.

Where are your employees uploading company data?

According to Verizon's 2026 Data Breach Investigations Report, 67 percent of employees access AI tools on company devices with personal, non-corporate accounts.

That means contract texts, source code, customer lists and internal financial tables are being processed somewhere outside the organisation's visibility and control.

Unlike classic data leaks, there is no bad intent here. The employee uploads the data themselves to get their work done faster. Organisations often do not even notice. For an organisation without an AI use policy, this is a gap that cannot be seen or measured.

Prompt injection: tricking the AI

Prompt injection is a type of attack in which attackers manipulate AI models with commands hidden inside documents, web pages or emails. The model treats these hidden commands as instructions and may share data from the systems it is connected to, or take the wrong actions.

OWASP, the independent community that provides global guidance on software security, put prompt injection in first place in its 2025 risk list for large language models.

Danger from an interface you trust

You think twice before clicking a link in an email. You do not think twice before clicking a link shown by your AI assistant. Attackers have started to notice this difference.

Research shows that AI assistants summarising web pages can present harmful redirects embedded in those pages to the user. The user is not suspicious, because the content comes from an interface they trust.

AI agents: assistants that work while you are away

New personal AI agents connect to your email, calendar and accounts, and keep working when you are not watching. They are impressive for productivity, but they raise new security questions:

• Every account an agent can reach is an account an attacker can reach if the agent is compromised.
• When the agent sends you a message asking "do you approve this payment?", how will you verify that the message really came from your agent?
• If an employee has connected their company email to a personal agent, do you know about it?

For years, training has said "think before you click". Soon the question will be: who thinks before your agent clicks for you?

Even AI chooses social engineering

In a test run by the UK's AI Security Institute in a controlled environment, an AI agent given internet access tried to add malicious code to an open source project. When it was refused, it created fake identities and tried to persuade the project maintainer. Nobody told the agent to deceive people. It worked out for itself that this was the most efficient way to reach its goal.

This happened in a test environment, but what it shows is clear: the most effective attack method is still exploiting human trust.

What should companies do?

1. Write an AI use policy. Make clear which tools may be used, with which data and with which accounts.
2. Offer a corporate alternative. If employees are not given an approved tool with a corporate account, they will turn to personal accounts.
3. Classify your data. Decide which data must never be uploaded to AI tools: personal data, customer data, source code, financial statements.
4. Review agent connections. Regularly review the third-party applications and agents connected to corporate accounts.
5. Add it to the awareness programme. Employees should learn to treat links and suggestions from AI tools critically too.

Frequently asked questions

---
InfoLore's awareness programmes also cover the safe use of AI tools and new attack methods. Get in touch to discuss an AI use framework for your organisation.