One in Five Data Leaks Now Linked to Shadow AI Usage as Employees Feed Sensitive Corporate Data into Public AI Services

Small and medium-sized businesses as well as large corporations are increasingly exposed to data leaks caused by employees’ unauthorized use of generative AI tools. Security teams are struggling to keep pace as staff send internal information to public neural networks faster than information security departments can identify the new risk vectors.

According to research by Informzashchita, in July 2026 already 20% of organizations that suffered data leaks were able to link at least part of the incidents to unsanctioned GenAI usage. One year earlier the figure stood at approximately 12%. These cases go far beyond simply asking a chatbot to edit an email.

Employees are uploading contracts, source code, internal correspondence, client inquiries, and technical documentation to public AI services. The study breaks down the primary vectors responsible for these leaks:

• 42% occur through public AI web interfaces;
• 24% are connected to browser extensions and AI assistants that gain access to tabs, session history, and cookies;
• 19% result from independently connected APIs and libraries;
• 15% involve tools designed for programmers.

Traditional security controls frequently fail to detect the activity because the domains are legitimate, TLS encryption is active, and no malware signatures are present. As a result, confidential documents are exfiltrated to external services without triggering alerts.

The research also found that nearly one-third of companies using AI have discovered at least one API key or secret stored in insecure locations such as configuration files, test scripts, workstations, and Git repositories. Attackers who obtain these credentials can not only consume the organization’s AI budget but also reach connected databases and RAG data stores.

Late detection significantly increases the financial impact: incidents involving shadow AI raise average breach costs by roughly $670,000. Experts advise organizations to begin with comprehensive service inventories, secret scanning, browser-extension governance, and data classification instead of attempting to ban tools such as ChatGPT by policy alone.