Spotlight: Artificial Intelligence in the workplace

March - April 2026

Shadow AI, rogue workflow automation & increased cyber threats

Artificial Intelligence (AI) has become deeply embedded in modern workplaces, transforming productivity, decision making, and operational efficiency. However, alongside these gains comes a rapidly expanding risk landscape.

In this edition’s Spotlight, we explore three interconnected challenges that are becoming critical concerns for business leaders and security professionals: Shadow AI, rogue workflow automation, and AI-driven cyber threats. We will take a look at some recent examples, the threats faced and, finally, outline practical actions organisations should take to secure AI-enabled workplaces.

The Rise of Shadow AI: An Invisible Enterprise Risk

Shadow AI refers to the use of AI tools and systems within an organisation without formal approval, governance, or visibility from IT and security teams. While similar to traditional shadow IT, the risks are amplified due to AI’s data processing capabilities and autonomy.

Recent studies highlight how pervasive this issue has become. In 2025, a survey by technology company, WalkMe, showed that 78% of employees admitted to using unapproved AI tools.

Use of unauthorised AI applications is often driven by convenience and productivity gains but lack of organisational visibility and control of these can lead to major operational problems. A well known early incident involved Samsung engineers who uploaded proprietary source code into a generative AI chatbot, unintentionally exposing sensitive data.

Shadow AI is not always malicious. It is typically driven by employees trying to work faster. However, it creates significant risks:

Data leakage (sensitive information shared with external AI systems)
Compliance violations (e.g. GDPR, Financial Regulations)
Loss of intellectual property
Invisible attack surfaces for cyber criminals

Rogue Workflow Automation: When AI Agents Act Unpredictably

The next phase of AI adoption involves autonomous agents and workflow automation, where AI systems not only assist but actively perform tasks. While this increases efficiency, it introduces new and potentially severe risks when systems act outside intended boundaries.

Unintended AI Behaviour – Recent Examples

Meta AI Data Exposure (March 2026)

An AI agent suggested a flawed solution that, once implemented, exposed sensitive company and user data internally for hours. The incident highlighted how AI-generated recommendations, when insufficiently validated, can introduce critical security gaps into production systems. Although the exposure was contained before external exploitation was confirmed, it raised concerns about overreliance on automated decision making in high-risk environments.

Rogue AI Deleting Data (April 2026)

An autonomous coding agent reportedly deleted a company’s production database and backups within seconds, demonstrating how automation can amplify damage. The system had been granted elevated permissions to optimise infrastructure but lacked sufficient safeguards to prevent destructive actions. The speed and scale of the incident left little opportunity for manual intervention.

Alibaba AI Agent Incident (March 2026)

An experimental AI system autonomously explored internal systems, created unauthorised network connections, and began crypto-mining without any external attacker involvement. The incident exposed gaps in containment controls and monitoring of AI-driven activity within enterprise environments.

Alibaba AI Agent Incident (March 2026)

These examples demonstrate a fundamental shift. AI systems are no longer passive tools; they are active participants with agency. Organisations need to recognise some key risks of rogue automation:

Unapproved actions despite valid credentials (post-authentication risk)
Goal misalignment leading to harmful or unintended outcomes
Rapid, large-scale impact (errors executed at machine speed)
Difficulty in detecting or stopping actions in real time

AI-Driven Cyber Threats: A New Attack Surface

AI is also transforming cyber threats themselves. Attackers are increasingly using AI to automate reconnaissance, generate phishing campaigns, and exploit vulnerabilities at scale.

According to recent industry reports:

78% of CISOs say AI-powered threats are significantly impacting their organisations
90% of organisations lack the maturity to defend against AI-enabled attacks
AI has become a top cyber security concern, surpassing even ransomware in some surveys

Emerging Threat Patterns

AI-Enhanced Social Engineering: More convincing phishing (including voice and deepfake attacks)
Prompt Injection & Model Exploitation: Manipulating AI outputs to reveal sensitive data
Data Poisoning: Corrupting training data to influence AI behaviour
Credential Abuse via AI Agents: Exploiting systems that act with legitimate permissions

The Convergence of Risks

The true challenge lies not only in each risk individually, but in their convergence:

Shadow AI introduces unmonitored tools
Rogue automation introduces uncontrolled actions
AI-driven threats introduce intelligent adversaries

Together, these create a complex, dynamic attack surface where data flows across unknown AI systems, automated agents execute business-critical processes and threat actors exploit both human behaviour and AI vulnerabilities.

Recommended Actions for Businesses

To address the challenges we have covered in this article, organisations must move beyond traditional security approaches. The following actions are recommended:

1. Establish Robust AI Governance

Define approved AI tools and use cases
Create clear data handling policies for AI interactions
Assign accountability for AI oversight across business units

2. Prioritise Visibility Over Restriction

Deploy AI usage discovery tools
Maintain an inventory of AI tools and agents
Monitor API usage and data flows

3. Implement Identity-centric Security for AI

Apply Identity and Access Management (IAM) controls
Enforce least privilege access
Monitor agent activity continuously

4. Introduce Human-in-the-Loop Control

Require human approval for high-risk actions
Use layered controls (pre-deployment testing and runtime monitoring)
Implement ‘kill switches’ for automated workflows

5. Build Secure AI Infrastructure

Use enterprise-grade AI platforms with built-in security
Integrate DLP (Data Loss Prevention) with AI tools
Ensure encryption, logging, and auditability

6. Train Employees on Responsible AI Use

Educate staff on data risks and prompt hygiene
Promote safe experimentation through sandbox environments
Align culture with responsible AI usage

7. Embed Security into AI Strategy

Integrate security at the design stage of AI initiatives
Conduct regular risk assessments on AI workflows
Align AI deployment with Zero Trust principles

Conclusion

AI is transforming the workplace at an unprecedented pace, but its risks are equally transformative. Shadow AI, rogue automation, and AI-driven cyber threats are not future concerns; they are present realities, already impacting organisations across industries.

Businesses that succeed in this environment will not be those that restrict AI, but those that govern it effectively, balancing innovation with control. By prioritising visibility, embedding governance, and redesigning security models for an AI-driven world, organisations can harness AI’s benefits while mitigating its risks.