Summary
Two years ago, shadow AI meant an employee pasting text into a chatbot. Today it includes coding agents with shell access, Model Context Protocol (MCP) servers holding long-lived API keys, and personal AI accounts used for company work. Most of it runs on laptops, as local processes and configuration files.
This paper pulls together the public research from 2024 to 2026 and sets out how to measure the same things on your own fleet in under a week, then a 30-day plan and a map to the regulations that ask for it.
The numbers
- 78%of AI users bring their own AI tools to workMicrosoft · 2024 · N=31,000
- 53%of 5,200 open-source MCP servers rely on static API keys or PATsAstrix · Oct 2025
- 24,008unique secrets found in MCP configuration files on public GitHubGitGuardian · Mar 2026
- +$670Kadded to average breach cost where shadow AI levels were highIBM / Ponemon · 2025
Key findings
- Unapproved AI is the norm, not the exception. 80% of surveyed US and UK employees use unauthorised AI tools; so do 68% of security leaders.
- The agent era multiplies the surface. Gartner expects up to 40% of enterprise applications to include task-specific agents in 2026, up from under 5% in 2025.
- MCP credentials are mostly static. Only 8.5% of servers studied use OAuth; 79% of key-based servers read their keys from environment variables.
- The supply chain is already being attacked. The first confirmed malicious MCP server, postmark-mcp, silently copied users' outgoing email in September 2025.
- Governance lags. 63% of breached organisations studied had no AI governance policy; 97% of those with an AI-related incident lacked proper AI access controls.
What is inside
- 01Shadow AI is the default
- 02MCP: the new integration layer
- 03Credentials in the config file
- 04Exposure and supply chain
- 05The cost of not knowing
- 06Why network controls miss it
- 07What a fleet scan should show
- 08A 30-day plan and regulatory map