Forget Data Leakage: Shadow AI's Real Threat Is Access Control
Summary: Shadow AI has shifted from a data leakage problem to an access control problem, as employees and business units build custom assistants, coding agents, workflow automations, and agentic applications faster than security teams can track them, many through browser extensions, SaaS-native features, developer tools, MCP servers, endpoint-based agents, and custom scripts. New research from Token Security and the Cloud Security Alliance maps how widespread this exposure has become, with agents inheriting creator-level privileges, running on service accounts with permissions nobody audited, and staying active six months after the employee who built them changed roles or left.
Key Takeaway: An agent connected to Salesforce, Snowflake, GitHub, Gong, and Slack can read, write, and delete data on inherited credentials, and most organizations have little to no agent inventory to know it exists.
Read the original at The Hacker News ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026