One in Five Data Leaks Now Linked to Shadow AI Usage as Employees Feed Sensitive Corporate Data into Public AI Services
Small and medium-sized businesses as well as large corporations are increasingly exposed to data leaks caused by employees’ unauthorized use of generative AI tools. Security teams are struggling to keep pace as staff send internal information to public neural networks faster than information security departments can identify the new risk vectors.
According to research by Informzashchita, in July 2026 already 20% of organizations that suffered data leaks were able to link at least part of the incidents to unsanctioned GenAI usage. One year earlier the figure stood at approximately 12%. These cases go far beyond simply asking a chatbot to edit an email.
Employees are uploading contracts, source code, internal correspondence, client inquiries, and technical documentation to public AI services. The study breaks down the primary vectors responsible for these leaks:
- 42% occur through public AI web interfaces;
- 24% are connected to browser extensions and AI assistants that gain access to tabs, session history, and cookies;
- 19% result from independently connected APIs and libraries;
- 15% involve tools designed for programmers.
Traditional security controls frequently fail to detect the activity because the domains are legitimate, TLS encryption is active, and no malware signatures are present. As a result, confidential documents are exfiltrated to external services without triggering alerts.
The research also found that nearly one-third of companies using AI have discovered at least one API key or secret stored in insecure locations such as configuration files, test scripts, workstations, and Git repositories. Attackers who obtain these credentials can not only consume the organization’s AI budget but also reach connected databases and RAG data stores.
Late detection significantly increases the financial impact: incidents involving shadow AI raise average breach costs by roughly $670,000. Experts advise organizations to begin with comprehensive service inventories, secret scanning, browser-extension governance, and data classification instead of attempting to ban tools such as ChatGPT by policy alone.
Related articles
Prompt Injection Emerges as Top Risk for LLM Applications in Production
Prompt injection attacks are moving from theoretical demonstrations to real-world exploits targeting AI assistants in enterprise environments. Attackers embed malicious instructions in emails, documents, and code comments that override developer rules when models process untrusted input. Incidents involving Microsoft 365 Copilot, GitHub Copilot, and Cursor have shown data exfiltration and remote code execution risks with severity scores above 9.0. The core issue stems from the lack of strict boundaries between trusted system prompts and untrusted external content fed into large language models. Defenses require layered controls including code-enforced permissions, input filtering, human confirmation for high-risk actions, and explicit marking of external data. Major vendors including OpenAI, Anthropic, and Google acknowledge that no single static defense can fully eliminate the threat. OWASP ranks prompt injection as the leading risk for LLM applications, urging organizations to treat AI agents as systems with untrusted inputs.
Microsoft Copilot Abused to Accelerate Corporate Account Takeovers and Bank Transfer Frauds
Cybercriminals can leverage Microsoft Copilot to speed up the compromise of corporate accounts and execute financial frauds. In a controlled simulation, researchers demonstrated how the AI assistant helped redirect a $247,500 bank transfer after gaining access to an employee's email. The attack begins with the creation of inbox rules that automatically delete suspicious login alerts, followed by rapid analysis of internal communications to identify high-value targets. Copilot was then used to replicate the victim's writing style and craft a convincing phishing email capable of stealing session tokens and bypassing multi-factor authentication. Once the executive account was taken over, the tool quickly located pending payments and generated a fraudulent request to alter the recipient bank details. The scenario highlights risks from legitimate AI features rather than any specific vulnerability in Copilot itself.
Vibe Hacking Rises: Generative AI Lowers Barriers for Offensive Security Operations
Generative AI is reshaping the cybersecurity threat landscape by dramatically reducing the cost of offensive security knowledge. Previously, attackers needed years of experience in reverse engineering and exploit development to conduct meaningful intrusions, but AI now assists with research, code generation, debugging, and adapting known techniques to new environments. This enables less experienced individuals to build functional attack chains in weeks rather than years. The article introduces the concept of vibe hacking, where attackers collaborate with AI assistants using natural language prompts in a process similar to vibe coding. Defenders can no longer rely on the scarcity of skilled adversaries and must shift toward continuous validation frameworks such as CTEM, AEV, and PTaaS. Senior human experts remain essential for risk judgment and business context, even as automation accelerates routine tasks.
Hunt.io Exposes Suspected Chinese Cyber Espionage Operation Using Agentic LLMs Claude Code and DeepSeek
In July 2026 Hunt.io published research on a suspected Chinese cyber espionage campaign uncovered through an exposed directory on a Hong Kong server. The leak contained 2,431 files including victim source code, operation logs, web shells, exploitation scripts, scan results and phishing page clones. Researchers identified traces of Claude Code and DeepSeek-v4-pro working together, with Claude Code handling agentic tasks and session context while DeepSeek supported reasoning, script refinement and next-step selection. The infrastructure cluster, known as TencShell, showed overlapping SHA-256 HTTP headers, SSH host keys and TLS certificates across 13 IP addresses. Multiple initial access vectors were observed, including SQL injection against Taiwanese and Thai government targets plus exposure of Supabase and Azure secrets. The report also references a parallel Anthropic disclosure on GTG-1002, another Chinese state-linked operation that used Claude Code for 80-90 percent of tactical work.