Shadow AI

Shadow AI is the AI-era version of shadow IT: employees and teams adopting AI models, browser extensions, API keys, and agent frameworks on their own, outside any approved process. It usually starts with good intentions, because someone wants to ship faster, but it leaves the organization unable to see what data is going to which model, or what it costs.

The risk is threefold. There is a cost dimension (untracked provider spend that only surfaces on the invoice), a data dimension (prompts and completions carrying PII or trade secrets to unvetted endpoints), and a compliance dimension (models that never passed legal or security review handling regulated data).

How is shadow AI discovered?

Shadow AI discovery looks for unapproved AI in five places: identity and OAuth grants, the browser, the network, AI features inside SaaS apps, and the endpoint itself. Many discovery tools focus on identity, browser, or network signals. Coding assistants, desktop AI apps, and command-line tools often show up only on the machine, so endpoint coverage fills the gap. See the definition of shadow AI discovery.

Bringing shadow AI into the light

You cannot govern what you cannot see. Behest gives shadow AI a controlled front door: route requests through one endpoint, and every call is attributed, budgeted, and policy-checked. Model allowlists block unapproved models at the gateway, PII scrubbing protects sensitive data, and the audit trail records what actually happened, converting unmanaged shadow usage into governed, costed usage.

Some shadow AI never passes through any central endpoint: coding assistants, desktop apps, and command-line tools that connect to AI providers straight from a laptop. Behest Radar is a free, observe-only app that shows which AI services a machine is using and, with permission, adds token counts for Claude Code, Codex CLI, and Claude Cowork and list-price cost for Claude models, so you can find that usage before you decide how to govern it.