A shadow AI stack is the set of AI tools, plugins, APIs, and ad hoc workflows that employees or teams use outside formal security and governance review. It often appears when people adopt a chatbot, model, or automation service before IT has approved the data flows, access controls, logging, or vendor terms.
It matters because hidden AI usage can create data leakage, compliance gaps, and untracked dependencies. Sensitive prompts, source code, customer records, or credentials may be sent to third-party services without proper safeguards. In attacks, criminals can abuse unsanctioned AI tools to move data out of approved channels or to bypass monitoring. Defenders counter this by inventorying AI usage, enforcing identity and data controls, reviewing vendor risk, and requiring audit logs and approval paths for any system that touches enterprise data.