Shadow AI, Rogue Agents, and Data Leaks: A Special Report on Navigating AI Risk

Enterprises are all in on AI. Although the use of artificial intelligence (AI) was once viewed with caution, it is now becoming a mandate for most enterprises. The result is a sprawling ecosystem of AI assistants, agents, browsers, and extensions, and autonomous workflows that touch every corner of the enterprise — from code writing and content generation to contract analysis and task automation.

While these AI tools are rapidly becoming essential productivity drivers, they are also quietly expanding organizations’ threat surfaces. As AI use increases, it introduces new categories of risk that traditional security tools were not designed to address. Security leaders are struggling to understand where their data is going, who has access to it, and how to secure these third-party systems.

Most organizations focus governance efforts on widely used AI platforms like ChatGPT, Microsoft Copilot, and Google Gemini. But employees are increasingly using AI apps or subscriptions that operate without corporate oversight. This creates a significant visibility gap into how business data is stored, retained, and processed.

According to LayerX data, nearly half of all enterprise AI conversations (47.11%) take place through personal identities rather than via corporate-managed accounts, creating a major governance visibility gap. And more than 14% of enterprise AI conversations involved personal “freemium” AI subscriptions, which exposes data to large language models (LLMs) for public model training.

The example of the Chinese AI company DeepSeek illustrates how explosive user adoption can overcome critical data security controls. This highlights the need for continuous visibility of AI applications that employees adopt independently.

AI fundamentally changes the data loss prevention (DLP) equation. Information transfer is no longer confined to well-defined and well-protected channels like email, file transfers, and cloud storage. With AI, sensitive information can be shared through prompts, conversations, snippets of code, copied text, and other unstructured forms.

While individual interactions may appear harmless, they can collectively expose valuable business context that legacy DLP controls were not designed to detect.

For example, this SOTI report spotlights the recent case of a U.S. government official who accidentally released sensitive, restricted operational data from the Cybersecurity and Infrastructure Security Agency (CISA) via a public AI infrastructure.

Employees are increasingly accessing AI through browser extensions that operate directly inside the browser. These browser extensions often have extensive access to web content, user activity, credentials, and enterprise applications.

LayerX research revealed that nearly 75% of AI browser extensions request high or critical permissions. This can create a channel for unmanaged AI access to sensitive data — a ripe target for malicious actors. The research also found that many AI extensions have known common vulnerabilities and exposures (CVEs).

Take CursorJacking, for instance — a sneaky security flaw that targets developers who are using the popular Cursor AI coding assistant. All it takes is a rogue browser extension for an attacker to quietly swipe Cursor API keys, impersonate a developer, and compromise the entire AI-driven dev environment.

The rapidly growing use of autonomous AI agents, together with AI browsers and agentic user interfaces, has created another new dimension of risk. The deeper these agents integrate into daily operations and sensitive data flows, the more they act as independent team members, making decisions with very little human supervision.

A new technique called CometJacking, which targets Perplexity’s Comet AI browser, illustrates the threat. LayerX researchers showed that by embedding malicious instructions within a web page, an attacker could manipulate the browser's AI agent through an indirect prompt injection attack, giving them free reign to access data and perform unauthorized actions.

This SOTI Security report clarifies the need for organizations to meet the challenge of this new, fragmented AI ecosystem by introducing strict AI governance over data flows, identities, extensions, and autonomous agents.

To help guide this effort, our report provides:

• A practical, field-tested mitigation framework
• An actionable checklist of recommendations for CISOs and security leaders

With the right security frameworks, organizations can tap the full potential of AI, without exposing them to new risks.