UK Cyber Agency Warns of Shadow AI Risks to Data and Agent Privileges

The UK's National Cyber Security Centre (NCSC) has issued a warning regarding the security implications of employees using artificial intelligence tools outside of their organization's approved systems, a phenomenon known as "shadow AI." This practice can inadvertently expose sensitive company or customer data and diminish an organization's oversight and control over its information assets. Research indicates that a significant majority of employees, around 71%, are utilizing AI tools that have not been sanctioned by their employers.

The NCSC further highlights that the emergence of AI agents introduces an additional layer of risk. If an AI agent possesses a vulnerability or is improperly configured, it could provide a pathway for attackers to access the same data, services, and privileges that the agent itself can utilize. The agency emphasizes that the solution is not to ban AI outright, but rather to make the officially approved AI pathways more accessible and user-friendly. To mitigate these risks, organizations are advised to understand the motivations behind shadow AI use, provide secure and viable alternatives, and actively manage and reduce the associated risks rather than expecting them to vanish.