rewrite this title Shadow AI and agents like OpenClaw are hijacking corporate data too easily

According to UpGuard’s late-2025 report, nearly 90 percent of security professionals use unapproved AI tools at work. The people responsible for enforcing security policy are, by their own admission, ignoring it. More than 80 percent of workers across all roles use unsanctioned AI, and executives are the most prolific offenders.

We’ve been here before. A decade ago, the fight was over shadow IT — personal Dropbox accounts, unapproved SaaS apps, data flowing through tools that never passed a security review. Most organizations eventually got that under control with CASBs, discovery tooling, and better-sanctioned alternatives.

But those playbooks assumed the tools were dumb pipes: they moved and stored data, and the fix was visibility into where it went. Shadow AI doesn’t work that way, because AI tools don’t just store your data — they process it, and in some cases retain it.

Article continues below

You may like

When someone pastes a customer list into a free-tier chatbot or feeds proprietary code into an LLM to debug it faster, that data enters a system the organization has no control over. There’s no audit trail, and often nobody knows it happened.

On the compliance side, that creates exposure that compounds the longer it goes unaddressed: no data processing agreement, no documented retention policy, and no ability to respond to a GDPR subject access request or demonstrate to auditors that sensitive data stayed within regulatory boundaries.

The costs of Shadow AI are measurable. Recent Netwrix research indicates that organizations with high levels of unsanctioned AI usage experience data breach costs that are, on average, $670,000 higher than those with lower usage.

And banning AI doesn’t fix it — Software AG found that 46 percent of employees would keep using unapproved tools even after an explicit ban. Prohibition just pushes the behavior underground.

There’s another cost that doesn’t show up in breach reports. When employees rely on unapproved models for analysis, drafting, or code generation, nobody is validating what comes back. Hallucinated data points end up in executive briefings.

Flawed code ships to production because the model that wrote it was never vetted against the organization’s standards. Legal teams draft language using tools that nobody in compliance has reviewed.

The accuracy of the organization’s own outputs erodes over time — and because the tools are unapproved, the teams using them have built workflows the business can’t see, can’t audit, and can’t replace if the tool changes its terms or gets cut off tomorrow.

What to read next

From chatbots to autonomous agents

Everything above describes employees using AI as a tool — typing a prompt, getting a response, pasting it somewhere. The next wave is different. Agentic AI systems don’t wait for prompts. They take actions: reading email, executing code, accessing files, chaining tasks together, all running with the user’s own permissions.

OpenClaw, the open-source AI agent that racked up 145,000 GitHub stars in weeks, shows where this is heading. As a productivity tool, it’s impressive. As an attack surface, it’s what Cisco called a security nightmare.

When Cisco’s AI security research team tested the top-ranked community extension on OpenClaw’s skill repository, they found it was functionally malware: it silently sent data to an attacker-controlled server via embedded shell commands while using prompt injection to bypass the agent’s safety guidelines.

That skill had been downloaded thousands of times. It was one of at least 230 malicious extensions uploaded to the repository within weeks of OpenClaw going viral. Kaspersky found 512 vulnerabilities in a single audit, eight of them critical. China banned it from government systems.

OpenClaw is one platform, but the pattern — broad system access, community-sourced plugins, weak default security — is the direction the whole category is moving. Gartner predicts 40 percent of enterprise applications will feature task-specific AI agents by the end of this year, up from under five percent in 2025.

These agents break the assumptions most security tooling is built on. An agent sending an email looks identical to the legitimate user. EDR sees normal traffic.

There’s no malicious binary to flag. And because agents process external content — emails, web pages, documents, images — adversaries can embed instructions in that content and hijack the agent’s behavior without any human clicking anything.

Researchers have already demonstrated a single poisoned email causing an agent to hand over private keys from the host machine.

What actually works

Blanket bans fail. That much is obvious from the data. What works is giving people something better to use. One healthcare system that replaced its AI ban with approved tools saw unauthorized use fall 89 percent.

People reach for shadow AI because it solves real problems faster than whatever IT has sanctioned. Close that gap and most of the risky behavior goes away on its own.

Beyond that, treat AI interactions like data transfers. Apply DLP policies to prompts. Classify what should never enter an external model.

Build visibility into what tools employees are actually using — BlackFog’s research suggests 99 percent of organizations currently have no way of measuring shadow AI activity in their environments.

For agentic AI, the bar has to be higher. Autonomous tools need sandboxing, least-privilege access, and proper vetting of every extension before deployment.

Security teams need monitoring built for AI-native threats — prompt injection, supply chain compromise through malicious skills, credential leakage through agent memory — because legacy endpoint tools weren’t built to catch any of this.

None of this works as a policing exercise, though. Governance has to feel like a service to employees, not a constraint imposed on them. The organizations that figure this out will be in a strong position. The ones still pretending it’s not their problem are already behind — their data has been leaving the building, one prompt at a time, for months.

We’ve featured the best online cybersecurity course.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit