AI Running in Your Company You Never Approved?

You have approved some AI at your company. A company account for a tool like ChatGPT or Copilot, bought properly, that everyone knows about. That part is fine, and it is not what this piece is about.

The part worth your attention is the rest. Across the companies we work with, in financial services, healthcare, government, and technology, we ask one question early: how much AI is running in your business right now. The first answer is tidy. The real number, a week later, is larger and comes with an uncomfortable pause.

That gap is people using AI to get their own work done faster, with nobody approving it:

• An analyst pays out of pocket for a Claude subscription because it helps them write.
• An ops lead runs a free online tool to clean up spreadsheets.
• Someone wired an AI into a reporting process last quarter and never mentioned it.

None of it went through you. None of it shows up on any list. All of it is touching company work.

This is shadow AI: any AI used on your business that nobody approved or is watching. A tool the company bought and knows about is approved, even when plenty of people use it. It becomes shadow AI the moment the company can no longer see it. Approved means someone chose it and can account for it. Shadow means no one did, and no one can.

For two years this was a manageable data problem. It has changed shape, and the new shape is why it is worth twenty minutes of your time.

It Used to Be People. Now It Runs on Its Own.

For two years, shadow AI meant one thing: a person uses an AI tool to work faster, and company information leaves your walls. Paste a customer list into a free chatbot to sort it, and that list now sits on a stranger’s computer. Manageable, because people can be trained and given safer options.

What is arriving now is different, because the AI no longer waits for the person. An AI agent is AI that does not just answer questions. It reads information, decides what to do, and carries out steps across your systems without a person approving each one. A chatbot drafts an email for you to send. An agent sends it.

That turns shadow AI from a data problem into an action problem. With a person using a tool, the worst case was information leaking. With an agent, the worst case is something done: a record changed, a file deleted, before anyone knew it was running.

The column on the right is where shadow AI has moved. Software making decisions and taking actions that nobody approved, and nobody is watching.

This Is Already Happening at Companies Far Better Resourced Than Yours

In March, an AI agent inside Meta posted an answer into a place it was not supposed to. The answer was wrong, a colleague acted on it, and sensitive company and user data became visible to people not cleared to see it for about two hours. No hacker, no break-in. TechCrunch reported it from an internal report.

The AI had been given that access legitimately, the way you hand an employee a key. It used the access in a way nobody had decided it should, and the noticing came after the doing. This was Meta, with more security staff than almost anyone on earth. It does not get safer with fewer people watching.

Give an agent access to something that matters and it turns expensive fast. In April, an AI tool at a car-rental reservations company deleted the entire database, the single place all its records lived, in nine seconds during a routine task. Every backup went too, the copies kept precisely so a disaster like this can be undone. It was doing its job and made a call. The founder spent the weekend rebuilding records by hand.

What Shadow AI Actually Costs You

Most articles about shadow AI stop at the scary story. That undersells it for anyone who runs a budget, because the everyday cost is bigger than the rare disaster. It shows up in three places you recognize:

• Money you spend twice. Four teams each build their own AI for the same job, in four corners of the budget, and nobody adds it up. An agent left running also bills continuously, whether or not anyone got value that day.
• Quality you cannot vouch for. Work nobody owns is work nobody checked against your standards. When it is right, you got lucky. When it is wrong, you hear it from a customer or an auditor.
• The same job, solved over and over. Built in isolation, these tools never learn from each other. Every team starts from scratch, so effort that should have cost you once gets spent five times.

The One Question That Sorts All of It

The instinct is to find it all and make a list. That worked a decade ago with unapproved software, because a rogue app just sat there until you found it. An agent does not sit there. It acts in the gap between when it starts and when anyone looks, so a list tells you what exists today, not the three more built next week the same way, with nobody deciding whether they should exist at all.

You do not need to become technical. You need to change the question your team answers.

Stop asking how much AI are we running. It produces a list that makes everyone feel briefly better and changes nothing. Ask instead: for each AI running here, is there a named person who could turn it off right now, and knows how.

That splits everything into two groups. The AI with an owner is an asset, because someone is accountable for it. The AI with no owner is your exposure, and no list closes that gap, because the gap was a decision nobody made: who owns the thing before it runs.

Three Moves That Actually Change the Picture

Asking the question is the start. Here is what to do with the answer, none of it requiring you to understand the technology underneath:

• Make an owner non-negotiable for anything new. No AI gets built or bought without a named person, a defined job, and a way to switch it off. Decide this before it runs. This one rule stops the problem from growing while you handle what exists.
• Sort what is running by what it can reach, not how clever it is. The AI with access to money, customer data, or systems that act gets an owner first. Cleverness is not your risk. Reach is.
• Ask for the off switch by name. For the AI that can reach the most, get one clear answer: who turns this off, and have they confirmed they can. If nobody can answer, you found your first real problem, cheap to fix now.

You will not settle all of this in one meeting. But this is how you find out, in plain terms, whether the AI in your company is a workforce you are running or a crowd you happen to be employing.

Sources

TechCrunch, March 2026: an AI agent at Meta exposed company and user data.

The Register, April 2026: an AI tool deleted a company’s entire database.