# What is shadow AI?

> Shadow AI is any AI tool staff use for company work without IT or security's knowledge, from an app to a browser extension.

Source: https://meshin.co/glossary/shadow-ai
Updated: 2026-10-02

---

## Why it comes up

It is usually the first uncomfortable finding of a readiness assessment, and nobody did anything malicious. The register a company thought was complete turns out to have gaps. That happens the moment someone checks browser extensions and expense reports, instead of asking teams to self-report.

A customer's security team asks about it, having had a bad experience before. A board hears one checkable question: could an employee be pasting customer data into a public tool right now?

## What to do about it

Look rather than ask: check browser extension inventories, expense reports for AI subscriptions, and API billing for model providers nobody remembers approving. Publish a short list of approved tools, and a fast route to request a new one. The main driver of shadow AI is an approval process slower than the problem it solves. Fold anything found straight into the AI register, rather than treating discovery and governance as separate steps.