NCSC Warns Shadow AI Creates New Security Risks
UK NCSC warns that unapproved AI tools used by 71% of UK employees expose corporate data and create hard-to-detect organizational security risks.
The UK's National Cyber Security Centre warned on 7 September that shadow AI, unapproved AI tools used outside organizational controls, creates visibility gaps and raises risks of data breaches, intellectual property loss, and regulatory non-compliance. It cited Microsoft research finding 71% of UK employees had used AI tools not approved by their employer. NCSC also warned AI agents can carry critical vulnerabilities, allowing attackers who exploit one to inherit the agent's data access, services and privileges, and that attackers are highly likely to abuse agents with looser guardrails. The agency recommended reducing rather than eliminating shadow AI through positive security culture and clear guardrails.
- Microsoft research cited: 71% of UK employees use unapproved AI tools.
- Risks include data breaches, IP loss, regulatory non-compliance, and reduced visibility into data flows.
- Vulnerable AI agents could let attackers inherit agent privileges and pivot into corporate IT.
- NCSC recommends reducing, not eliminating, shadow AI with open dialogue and clear secure-use guardrails.
Full article430 words · extracted from infosecurity-magazine.com · click to collapse
The UK's National Cyber Security Centre (NCSC) has warned that employees using unapproved AI tools can expose corporate data and create security risks that organizations may struggle to detect and manage.
The NCSC blog post, published on September 7, said shadow AI was likely to persist as employees adopted new services faster than organizations could assess them and provide approved alternatives.
The agency cited Microsoft research that found 71% of UK employees had used AI tools not approved by their employer. The NCSC said the research suggested shadow AI use was widespread.
Unapproved AI Tools Create Visibility Gaps
Shadow AI refers to AI technology that falls outside an organization's approved systems and processes and is a form of shadow IT.
"Many people are reaping the benefits of AI in the workplace and are rightly being supported to do so by their employers, but IT security teams should not assume they are seeing the full picture," said David Chismon, NCSC CTO for architecture.
The NCSC said employees who give shadow AI access to company or customer data likely increase the risk of data breaches, intellectual property loss and failure to meet regulatory requirements.
The blog post said the problem could emerge when existing cybersecurity policies failed to meet business needs, encouraging staff to adopt new services before their employer had assessed them.
Read more on shadow AI: One In Four Employees Use Unapproved AI Tools, Research Finds
The NCSC also warned that AI agents could carry critical vulnerabilities, and that an attacker exploiting one could gain the same data, services and privileges the agent legitimately held.
It explained that attackers were highly likely to use agents with looser guardrails to exploit vulnerabilities or misconfigurations elsewhere in corporate IT.
Organizations Urged to Reduce Shadow AI Risks
Employees who transfer sensitive information to consumer AI services are likely reduce their organization's visibility and control over it, the NCSC said, because that information may be stored, retained or used to improve the service.
The agency warned that organizations should focus on reducing rather than eliminating shadow AI, as with shadow IT more broadly. It recommended adopting a positive cybersecurity culture so employees felt able to discuss security issues openly.
"Organizations can't hope to block connections to all possible AI tools, so they need to develop a positive cybersecurity culture with open dialogue about the tools staff might wish to use and to set clear guardrails around what secure use of AI looks like," Chismon said.
The NCSC also pointed to guidance on the careful adoption of agentic AI services, published with international partners.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/ncsc-warns-shadow-ai-security-risks/