Shadow AI is any use of AI tools outside the ones your organisation has approved and controls: a personal ChatGPT account used for work, a browser extension that sends page content to a model, a developer’s script calling an LLM API with a key on their laptop, an AI agent given access to a shared drive. It is everywhere. Microsoft’s 2024 Work Trend Index found that 78% of AI users were bringing their own AI tools to work. [1] Verizon’s 2026 DBIR found that 67% of users accessing AI services on corporate devices did so with non-corporate accounts. [2]
It is now a breach cause in its own right. IBM’s 2025 Cost of a Data Breach study found that one in five organisations reported a breach due to shadow AI, and that high levels of shadow AI added an average of $670,000 to breach costs. [3]
What a Shadow AI attack looks like
“Shadow AI attack” can mean four different things, and each leaves different traces in your logs:
- Data leakage: an employee, or a compromised account, sends sensitive data to an external AI service.
- Agent and API-key abuse: a script, service account or AI agent with an API key collects data in bulk and sends it out.
- External AI agents probing you: AI crawlers and agents enumerating your web applications faster than any person could.
- Prompt injection against your own AI app: attackers steering a chatbot or AI feature you have built into running commands or leaking data.
Detect sensitive data sent to an AI service
This is the one most organisations worry about, and it follows a three-stage pattern. Each stage alone is ordinary. Together they are a leak.
| Stage | Logs that show it | What to look for |
|---|---|---|
| Reads sensitive or bulk data | Windows file auditing, Sysmon, Microsoft 365 audit, database audit | A burst of file reads, downloads or record exports by one user or host |
| Connects to an AI service | Proxy, DNS, firewall, Zeek | Connections to chatgpt.com, claude.ai, gemini.google.com, copilot.microsoft.com, perplexity.ai and similar services |
| Uploads a lot to it | Proxy, firewall, Zeek | Large or repeated outbound transfers to that same AI service |
Alerting on every connection to an AI service would bury the SOC, because most of it is harmless. The useful rule is the correlation: any two of these three stages on the same host or user within two hours. Someone who opens a customer export and then uploads 40 MB to a chatbot is worth a look. Someone asking a chatbot to fix a spreadsheet formula isn’t.
Keep your list of AI domains current, because new services appear every month. Split it into sanctioned and unsanctioned services, so the same rule stays quiet for your approved enterprise tenant and alerts on personal accounts and unknown tools.
Shadow AI detections, ready for your SIEM
LogLens includes four Shadow AI attack stories: sensitive data sent to an AI service, AI agent or API-key abuse, external AI agents probing your web apps, and prompt injection against your own AI app. It shows which stages your logs can see, and deploys each one as a single correlation rule.
See the Shadow AI attack stories →Detect AI agent and API-key abuse
LLM APIs are ordinary HTTPS endpoints: api.openai.com, api.anthropic.com, Azure OpenAI, Amazon Bedrock, Google Vertex AI and others. Calls to them from a server, a service account or another non-interactive identity are rarely approved by accident. Look for:
- Traffic to LLM API endpoints from servers and service accounts, not just from user laptops.
- Automated collection: one identity reading many files, mailboxes, records or cloud objects in a short burst, seen in Microsoft 365 audit, CloudTrail or database logs.
- A large outbound transfer by the same identity shortly afterwards. [4]
Again, two of the three for the same identity within a few hours is the alert.
Detect AI crawlers and agents probing your web apps
AI crawlers and agents often identify themselves. Web server, WAF and CDN logs show user agents such as GPTBot, ClaudeBot, PerplexityBot, CCBot and Bytespider. Crawling alone isn’t an attack. The same source moving on to high-rate enumeration (bursts of 403 and 404 responses), then injection attempts or repeated login failures, is. Correlate on the source address within an hour.
Detect prompt injection against your own AI apps
If you have built a chatbot or an AI feature, it is now part of your attack surface. Prompt injection is the top risk in the OWASP Top 10 for LLM applications. [5] Look for injection and jailbreak phrasing in request parameters and bodies, such as “ignore previous instructions” or requests for the system prompt. Then look for the AI application’s host doing something unusual: its runtime (python, node, java or w3wp) starting a shell or network tool, or sending a large transfer to an external destination.
The logs you need
- Web proxy or secure web gateway logs with full host names and byte counts. This is the single most valuable source for Shadow AI.
- DNS logs, to catch AI services even when traffic bypasses the proxy.
- File and SaaS audit logs (Windows object access, the Microsoft 365 unified audit log, Google Workspace, database audit) for the “reads sensitive data” stage.
- Cloud audit logs (CloudTrail, Azure activity) for API keys and AI services used inside your own cloud accounts.
- Web server and WAF logs for crawlers and prompt injection against your own applications.
Detection is half the answer
A SIEM tells you that data went to an AI service after it happened. To stop it in the moment, you need a control where the data leaves, and for most AI tools that is the browser. Browser-level controls can tell sanctioned AI platforms from unsanctioned ones, warn on or block the rest, and keep confidential data out of unsanctioned AI at the moment of the paste. SafeToOpen covers that side in Shadow AI and Shadow SaaS governance. The two work best together: the browser control prevents, and the SIEM correlation catches what gets through, including automated agents that never open a browser.
IBM found that among organisations reporting a breach of an AI model or application, 97% lacked proper AI access controls. [3] Detecting Shadow AI in your SIEM gives you the evidence to set those controls, and a way to check that they work.