One in Five Organizations Report Security Incidents Tied to Shadow AI

Unauthorized AI tools are moving from a policy problem to a measurable security risk. A new survey from DNSFilter found that 20.1% of organizations experienced a security incident tied to an unapproved AI connection.

The research surveyed 400 IT and cybersecurity managers and executives in the United States and Canada at organizations with 150 to 5,000 employees. Censuswide conducted the study from June 15 through June 26, 2026.

Nearly half of respondents, 46.1%, said an employee had connected an unapproved AI tool even when controls were in place. Forty-three percent said they learn about OAuth or API access only after the connection happens, or never discover it at all.

DNSFilter’s network data points to a larger visibility gap. The company recorded 3.4 billion generative AI requests from more than 43,000 organizations in August. A typical organization used five AI tools per day, while 15.2% used more than 10. Only 0.5% of survey respondents believed their organization used that many.

DNSFilter’s report suggests security spending is beginning to follow the risk. About 40.3% of respondents said the next additional security dollar should go to AI security and governance.

For defenders, the problem is not only employees pasting sensitive data into chatbots. AI services can gain persistent OAuth permissions, connect to cloud files and trigger automated actions, creating access paths that may outlive the original user session.

Security teams should discover AI traffic, audit OAuth grants and API tokens, and define which tools may handle regulated or proprietary data. Controls should give employees an approved path to use AI while flagging services that create hidden or excessive access.