Shadow AI in Australian Workplaces: Why Banning Tools Makes It Worse

The short version

• Shadow AI is the use of AI tools at work that your organisation has not approved, does not know about and cannot see.
• It is not a fringe problem. Around 27% of Australian employees have used generative AI secretly at work, and 49% teach themselves AI through ad hoc trial and error. Deloitte Access Economics, cited in Jobs and Skills Australia, Our Gen AI Transition, 2025; RMIT Online and Deloitte Access Economics, Beyond Prompting, March 2026.
• The real risk is not mainly that someone breaks a policy. It is prompt injection, unvetted vendors, personal accounts outside your identity controls, and no way to detect or report a breach.
• Blocking tools is understandable, but often counterproductive. Staff can route around controls and move the same work to personal accounts and devices, where you have no visibility at all.
• The fix is a sequence, not a ban: assess the risk, decide what is permitted, sanction a short list, train people properly, then monitor.
• Explore our practical 30, 60, 90 day plan below.

The gap is the point

Most Australian organisations would answer, “No, we do not use AI.” Most of their staff would answer, “Yes, I do.” The space between those two answers is where shadow AI lives.

Risk 1

Prompt injection: your data leaves without anyone pasting it

Prompt injection has ranked first in the OWASP Top 10 for LLM Applications for three consecutive years, including the 2026 edition published in August 2026. Sensitive information disclosure ranks second and excessive agency third.

The attack does not need a careless employee. Instructions hidden in content the AI reads are enough.

• EchoLeak (CVE-2025-32711) was the first documented zero click indirect prompt injection against a production system, in this case Microsoft 365 Copilot. Instructions concealed in an incoming email caused Copilot to exfiltrate recent emails and drafts through an automatically loaded image URL. The user did nothing but receive a message.
• Brave Research demonstrated the same class of attack against an AI browser in August 2025, using white on white text and HTML comments in a webpage to extract a user's email address and a one time password. In October 2025 they showed the same thing hidden inside screenshots.

EchoLeak was patched centrally because it was in a sanctioned enterprise product. A personally installed AI browser or extension sits behind none of your controls and generates no telemetry you can search afterwards.

Risk 2

Vendor and supply chain risk

The consumer and business tiers of the same product are governed by different terms, and that split is the whole problem.

• OpenAI trains on consumer ChatGPT conversations by default unless the user opts out. It does not train on inputs from ChatGPT Team, Enterprise or the API.
• Anthropic trains on Free, Pro and Max account data where the setting is on, with retention extended to five years for those accounts. Team, Enterprise and API are excluded.

An employee on a personal account sits on the training by default, long retention side of that line no matter what your enterprise agreement says.

Vendor security maturity also varies enormously. In January 2025 Wiz Research found a publicly exposed, unauthenticated DeepSeek database leaking over a million log entries including chat history, API keys and plaintext passwords. The risk extends past the vendor too: in November 2025 OpenAI notified customers of a breach at Mixpanel, an analytics sub-processor. OpenAI's own systems were not breached.

Risk 3

Identity and access

This is the least discussed and, for most organisations, the most serious. Around 67% of enterprise AI usage happens through unmanaged personal accounts, and 82% of data pastes into AI tools originate from personal accounts. Netskope's January 2026 report found incidents of sensitive data sent to AI apps doubled year on year.

A personal account is outside your single sign on, outside your multi factor policy, and outside your offboarding. When that person leaves, the account and everything in it leaves with them.

• The Salesloft Drift breach is the case to know. In August 2025, a threat actor abused compromised OAuth tokens belonging to an AI chat agent to reach multiple corporate Salesforce instances, hunting for AWS keys, passwords and Snowflake tokens. Nobody breached Salesforce. One AI vendor's OAuth grant became a key to hundreds of tenants.
• In January 2026, researchers found two Chrome extensions with roughly 900,000 users between them exfiltrating full ChatGPT and DeepSeek conversations and every browser tab URL, including internal corporate URLs, every thirty minutes. One carried a Google “Featured” badge.

That last detail is worth sitting with. Internal hostnames, tenant identifiers and internal path structures are reconnaissance material, and they were leaving through something staff installed believing it was a productivity aid.

Risk 4

You cannot report what you cannot see

Australia's Notifiable Data Breaches scheme recorded 1,205 notifications in 2025, the highest annual total since the scheme began, with 59% attributed to malicious or criminal activity.

Shadow AI does not create an exemption. It creates an inability to comply. You cannot assess or notify an eligible data breach involving a system you did not know existed, on an account you cannot access, at a vendor you have no contract with.

IBM's 2025 breach research puts the additional cost of shadow AI at USD $670,000 per breach, and found that 97% of organisations suffering an AI related security incident lacked proper AI access controls.

Step 1

Assess

Before anything else, work out whether AI is safe to use here at all, and in what form. This is a security and risk function, not a staff preference exercise.

Some environments should prohibit general purpose AI tools outright. Defence, intelligence, classified, and some health and legal contexts are obvious cases. As a concrete marker of where that line sits, Microsoft's agent mode is not available in GCC, GCC High, DoD or sovereign clouds at all. If your environment is one where that matters, no amount of staff training changes the answer.

Others need a locked down deployment rather than a general one: tenant hosted, no consumer connectors, restricted data grounding, logging on. The joint Five Eyes guidance Careful adoption of agentic AI services, published 30 April 2026 and co authored by the ACSC, is the reference point. It names prompt injection, agent identity compromise, unvetted third party components and privilege creep as the risks to work through.

Step 2

Decide

Security sets the boundary of what may be explored. Not staff, and not the enthusiasm of whoever got there first. The output of this step is a governance framework and a documented risk position, which is what a usable policy is later written from. A policy written before this is guesswork.

Step 3

Sanction

Now name the approved tools. Two or three, not fifteen. State what each may be used for and what may never be entered into it. Publish it where people will find it. The most common failure is approving a tool and never telling anyone.

Step 4

Train

Training is what turns a policy into behaviour. It needs to cover four things specifically.

1. What data must never leave, named concretely, and why.
2. Which tool for which task, so people stop reaching for a public chatbot to do something their licence already covers.
3. How to recognise a prompt injection attempt, and why output that asks you to take an action should be treated as untrusted input.
4. How to check output before it reaches a customer, the public or an executive.

Step 5

Monitor

Once tools are sanctioned and people are trained, monitoring becomes reasonable rather than adversarial. You are checking that a system works, not hunting for offenders. Staff can tell the difference, and it determines whether they cooperate.

Days 1 to 30

Assess before you permit

• Run a risk assessment first. Determine whether general purpose AI tools are appropriate in your environment at all, which data domains are out of scope entirely, and whether you need a restricted deployment rather than a general one.
• Have security and risk set the boundary of what may be explored, before any tool evaluation begins.
• Run a short, explicitly amnestied survey to find out what is already happening. Say plainly that no one is in trouble.
• Check which licences you already pay for, and how many are genuinely used.

Days 31 to 60

Decide, then write it down

• Agree a governance framework and a documented risk position. The policy is written from that, not instead of it.
• Approve a short list of tools with specific permitted uses and named prohibited data.
• Decide who may connect AI tools to corporate systems, what OAuth grants are permitted, and who reviews them.
• Brief managers before staff. AI for Business Leaders and Managers is usually the first cohort to train, not the last.

Days 61 to 90

Train and open it up

• Deliver training against the four points in the previous section: prohibited data, tool selection, recognising prompt injection, and checking output.
• Read what the DTA Copilot trial found about training before designing the programme.
• Create a place where people share what works, so good practice spreads instead of hiding.
• Re-run the survey. Movement in unapproved tool use is your actual measure of success.

Private sector organisations

Australia has no AI specific statute. The National AI Plan, released on 2 December 2025, did not proceed with the mandatory guardrails proposed in the 2024 consultation, relying on existing technology neutral law.

That is not the same as having no obligations. Privacy law, the Notifiable Data Breaches scheme, consumer law, confidentiality obligations and work health and safety duties all still apply. The OAIC advises against entering personal information into publicly available generative AI tools, and expects organisations using AI to have policies, controls, human oversight and robust training and auditing measures.

Public sector organisations

Training is now mandatory. The Digital Transformation Agency's Policy for the responsible use of AI in government version 2.0 took effect on 15 December 2025. It makes foundational AI training mandatory for all APS staff, with the first requirement commencing 15 June 2026.

In New South Wales, the AI Operational Policy requires public servants to complete AI literacy and policy training if they use AI in their work, and requires agencies to make those courses available.