In depth
Shadow AI is unsanctioned AI use inside an organisation: a paralegal pasting a contract into ChatGPT, an engineer routing customer data through a personal Claude account, a marketer summarising a confidential roadmap with a free Gemini tab. Shadow AI is widespread because the tools are free, fast, and a single browser tab away. In UpGuard's 2025 State of Shadow AI survey of about 1,000 US and UK employees, 81% said they use AI tools their employer has not approved. The risk is not the tool itself; it is the absence of any control point between the employee and the model.
Examples
- An associate pasting deposition excerpts into a personal ChatGPT account to draft questions.
- A finance analyst using Gemini to summarise customer churn data outside the firm's approved BI stack.
- An engineer routing production logs through Claude to debug a flaky test, including PII in error messages.
How Locke handles shadow ai
Locke covers shadow AI on the surfaces it screens — the AI websites in its catalog, and the command-line and API traffic its local proxy sees — sanctioned or not, without depending on a corporate proxy or admin console. Detection runs locally, so privacy is preserved even when the AI itself isn't approved.
See the productRelated terms
- Prompt Leakage
The unintended disclosure of sensitive information through the content of a prompt sent to an AI model.
- Privacy Layer for AI
A control point between a user and an AI service that detects, transforms, or blocks sensitive data before it reaches the model.
- Data Loss Prevention (DLP)
A category of security tooling that inspects outbound data flows to prevent sensitive content from leaving an organisation's control.
