NCSC Warns That Shadow AI Can Expose Workplace Data
The UK's National Cyber Security Centre says staff using AI services outside approved company systems can weaken data control and create security blind spots. Its advice is to understand why people use the tools and provide safer alternatives, not pretend the behaviour can be banned away.
The short version
What you need to know
- The NCSC defines shadow AI as AI technology used outside an organisation's approved systems and processes, including familiar consumer tools adopted for work tasks.
- Copying company or customer information into an unapproved service can move it outside established retention, access and compliance controls. Connected AI agents can also inherit access to data and services.
- Employees should use approved tools and avoid submitting sensitive work material without clear permission. A VPN protects the connection, not information deliberately sent to an AI provider.
What the NCSC means by shadow AI
The UK's National Cyber Security Centre published new guidance on 7 September about shadow AI: the use of AI tools that are not captured by an organisation's approved systems and processes. It is the AI version of shadow IT, where staff adopt a service because it is convenient before security, legal or privacy teams have assessed it.
The NCSC is not telling people to stop using AI. It says the use of unapproved tools is unlikely to disappear completely and organisations should understand the business need, offer secure alternatives and build a culture in which staff can discuss what they are trying to accomplish.
How an ordinary prompt can become a data-control problem
A prompt can contain more than a question. Staff may paste customer details, internal documents, source code, contracts, meeting notes or unreleased plans into a consumer service. Depending on the product and settings, that material may be stored, retained or used outside the employer's normal governance arrangements.
The NCSC also warns that AI agents can have access to data, services and privileges needed for their legitimate tasks. If an agent has a security flaw, weak guardrails or excessive permissions, an attacker may be able to reach the same connected resources. That risk is different from a chatbot simply producing an inaccurate answer.
What staff and organisations should do
Employees should check the approved-tool policy before uploading work material, remove names and confidential details where a task does not require them, and ask a manager or security contact when the data boundary is unclear. A personal subscription or familiar app interface does not make a service approved for company information.
Organisations should learn which tasks are driving unofficial use, provide a usable approved route, limit integrations to the data and actions required, and keep human confirmation for sensitive changes. Access reviews, logging, retention controls and a straightforward way to report mistakes are more practical than a blanket rule nobody can follow.
Where a VPN helps — and where it does not
A reputable VPN can encrypt supported traffic between a device and the VPN provider, reducing local-network visibility when staff work from hotels, trains, cafes or shared accommodation. It can also replace the device's usual public IP address for many destinations.
A VPN cannot stop an approved or unapproved AI service receiving text or files that the user intentionally submits. It does not change the service's retention policy, remove broad account permissions, audit an agent's actions or bring a consumer tool inside company governance. Tool approval, data minimisation and permission controls address those risks.
VPN Rocks view
Shadow AI is a workflow problem as much as a policy problem. If the approved route is too slow or cannot perform the task, staff will keep looking for shortcuts. Security teams need visibility and credible alternatives rather than a false assumption that an unused policy has removed the behaviour.
For users, the safest pause comes before the prompt is sent: identify whose data is present, whether the service is approved and what access the tool has. Network encryption remains useful, but it cannot make a voluntary disclosure private.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.
