Skip to main content
Featured blog image for Understanding shadow AI in your endpoint environment
Emerging Issue

Understanding shadow AI in your endpoint environment

Generative AI–and large language models in particular–reached mass consumer adoption beginning in late 2022 and early 2023, with ChatGPT reaching 100 million users faster than any consumer application in history.

Since then, AI has advanced at a breakneck pace and now seems to be incorporated in every tool, app, and website–regardless of how useful it might actually be. There are incredible, powerful, force-multiplying uses for AI technologies, but the rapid expansion and adoption pose risks most organizations were not prepared to handle—especially as AI systems move beyond experimentation and into action, creating the conditions for agentic AI sprawl where autonomy and scale outpace visibility and control.

[See how recent agentic AI developments are moving autonomous systems from advisory roles into direct execution—and what that shift demands from IT governance]


Yes, AI is a bold new frontier, but asset management and visibility continue to be the foundation of good security and risk management. We’ve gone beyond hardware, operating systems, and installed software and must now consider things like software-bill-of-materials (SBOM), browser ecosystems, integrated development environments (IDE), cloud-based Software-as-a-Service (SaaS), and all the ways AI can show up in your organization.

Let’s review the landscape, the threats, and the core components you need to get a handle on the challenge.

What is shadow AI?

Most tech professionals from helpdesk to C-suite are intimately familiar with "shadow IT"–the software and devices that employees use without formal approval. Like its predecessor, "shadow AI" refers to the presence or use of AI tools, apps, or infrastructure without the knowledge or approval from IT or security teams.

In most cases, use of shadow AI is innocuous. Most individuals want to maximize their productivity with a new technology, or perhaps they’re using a tool they don’t even realize has AI capabilities baked in. The risk of shadow AI isn’t in the presence of AI tooling alone, it’s in the connections, actions, and data flow that you may not have visibility into. In addition, unlike shadow IT, shadow AI can act, decide, and propagate risk autonomously.

There’s a significant visibility gap in shadow AI coverage:
Traditional security tools (cloud DLP, CASB, firewalls) are blind to local AI. Local- and cloud-based AI require different techniques for monitoring. Unfortunately, the speed of exposure and adoption to AI is outpacing our ability to govern and secure.

To understand where shadow AI hides and why it’s so hard to manage, it’s helpful to know some of the main forms it takes in enterprise environments today.

The first example is local AI models where the AI language model runs directly on a user’s machine or an internal server rather than in a cloud service like ChatGPT, Copilot, or Claude’s browsers or apps.

The second mechanism is AI agents which expand the capability of the LLMs beyond answering questions and allow them to carry out actions, connect to other tools and data, and operate with some degree of autonomy. Both mechanisms carry risks, and both can show up whether you’ve approved them or not.

Local models

The appeal of local models comes down to one word: privacy.

When you use a cloud-based AI service like ChatGPT, Gemini, or Microsoft Copilot, your prompts and the data you share travel to servers owned by a third party. That data can be used to train future models, stored in ways you can't audit, or in some cases inadvertently exposed, such as when ChatGPT introduced a “share” feature in 2023 with a checkbox to make the chats discoverable by search engines. Thousands of users enabled the feature without realizing what they were doing, and “private” conversations became Google hits.

Running a model locally means your data never leaves your machine or your internal network, which sounds like exactly the right answer for organizations handling sensitive documents, operating in regulated industries, or supporting environments where outside internet access isn't possible.

Sounds great, right? Not so fast. Local installation doesn't automatically mean private. In July 2025, Trend Micro discovered over 10,000 servers running Ollama, a popular open-source tool for running AI models locally, that were publicly exposed with no authentication required.

An improperly configured local model server can be queried by anyone who can reach it, meaning an attacker can probe it for information, extract data, or use it as a foothold into the broader network, without ever having physical access to the machine it runs on.

Local models are typically smaller and trained on less data than their cloud counterparts, which means they have more gaps in their knowledge and are more likely to fill those gaps with information that sounds plausible but is incorrect, what the industry calls hallucination.

For individual use, a confidently wrong answer is an inconvenience. But when local AI output flows into regulatory filings, financial analyses, legal documents, or customer communications, the stakes change entirely. An executive who doesn't know a summary was AI-generated has no reason to verify it, and by the time the error surfaces, the document may already be signed, sent, or submitted.

Local models have legitimate, valuable use cases, but "local" is not a synonym for "safe." Knowing what's installed, where it's running, and whether it's configured securely are the baseline requirements for using them responsibly at enterprise scale.

Agents

AI agents go beyond answering questions. Where a large language model like ChatGPT responds to prompts, an agent can take actions: writing and running code, updating records in your CRM, managing your calendar, or sending communications on your behalf. That capability is what makes them powerful, and what makes them risky.

The risk comes from how agents get their permissions. An agent inherits the access of the user who installs it. If that user is a developer with local admin rights, database credentials, and API keys, the agent has all of that too.

This is the AI equivalent of a living-off-the-land attack: no malware required, just legitimate access being used in ways nobody anticipated. There are currently no enterprise-wide standards for when an agent should pause and request human approval before acting, and most tools require permissions to be configured per user, making fleet-wide governance nearly impossible today.

That gap is already being exploited at the model level. A 2025 research paper from Lupinacci, et al. found that 100% of tested AI models applied looser security standards when receiving instructions from other AI agents than from a human.

A compromised agent in a multi-agent workflow can pass malicious instructions to other agents that would be blocked if a human sent them. The researchers call it an "AI agent privilege escalation" vulnerability built into current LLM architectures.

Model Context Protocol (MCP)

Anthropic created an open standard called Model Context Protocol (MCP) to give AI tools a way to connect to other tools, data sources, and systems. Think of it like a USB-C cable: instead of every device needing its own proprietary connector, MCP gives AI a single standardized way to interact with your mailbox, your filesystem, your browser, your database, and anything else that exposes a compatible interface.

That standardization is also what makes MCP a significant enterprise risk. MCP servers can be installed directly into developer tools like VSCode or Cursor with little to no visibility from IT or security teams. They inherit the permissions of whoever installs them, and since many developers are local admins with credentials, API keys, and tokens already on their machines, a compromised MCP server doesn't need to do much to have broad access. This is "shadow MCP," a subcomponent of shadow AI that carries an outsized blast radius.

The attack surface is multifaceted, and a subject for deeper dives on various techniques, but some examples include:

  • Tool poisoning, where attackers embed malicious instructions inside tool descriptions using characters invisible to humans but readable by the AI, causing it to take actions the user never intended.
  • Rug pulls, where a legitimate MCP tool is silently updated post-install to reroute traffic or log sensitive data to a third-party server, with no visible change to the user.
  • Cross-server tool shadowing, where a malicious server injects itself into a legitimate one. In 2025, attackers shadowed the official WhatsApp MCP server and used it to silently exfiltrate entire chat histories.
  • Supply chain compromise, where a malicious server is the product from day one, published to an unverified registry and installed by a user who had no reason to suspect it. With no standard vetting process for MCP servers, this is one of the most likely vectors for most organizations.
  • Session hijacking, illustrated by CVE-2025-6514, a critical OAuth vulnerability in a widely used MCP component that allowed attackers to gain persistent access to an estimated 437,000 development environments.

There are now over 15,000 MCP servers in the wild. With that volume of new development and no mature security standards in place, the CVE count is growing fast. This ecosystem is early, largely ungoverned, and actively being probed.

Tanium insights and real-world risk

In September 2025, a Chinese state-sponsored threat actor used Claude Code, Anthropic’s AI coding agent, to autonomously conduct reconnaissance, exploit vulnerabilities, and exfiltrate data from approximately 30 organizations.

AI executed an estimated 80 to 90 percent of the tactical operations independently. That same month, researchers demonstrated a zero-click attack against ChatGPT’s Deep Research feature: a single crafted email containing a hidden prompt injection silently exfiltrated Gmail data with a 100 percent success rate, requiring no action from the victim.

On the supply chain front, a campaign called GlassWorm distributed malicious extensions through the OpenVSX marketplace, accumulating over 10,000 downloads. The extensions used invisible Unicode characters to hide their code and routed stolen data through a Solana blockchain command and control infrastructure—two techniques specifically designed to evade detection.

In each incident, organizations had no visibility into the conditions that made the attack possible.

Tanium Guardian research gives a view into how widespread shadow AI actually is across enterprises. We look at two dimensions: local AI model artifacts on endpoints (e.g. model files and framework paths) and MCP server configurations (which MCP tools are present and where).

What we see is a clear story: shadow AI is already present in a meaningful share of environments, and both local model artifacts and MCP adoption are concentrated in ways that matter for visibility and policy.

What Tanium observes

Tanium Guardian research points to a familiar story: a sharp rise in AI adoption across enterprises, with one in three environments already showing at least one endpoint with indexed AI model files and nearly half with at least one endpoint where an MCP server is configured.

The presence of AI on the endpoint is no longer the open question. It’s there, and it’s growing. The open question is whether that presence is authorized, governed, and understood.

In practice, what we see tends to split into two patterns: some organizations look like they’re rolling AI out in a coordinated way; in others, adoption looks more like a slow trickle, the kind of pattern that could signal shadow AI, with tools and integrations showing up without a clear, central hand on the tiller.

On the local-model side, the artifacts tell their own story. GGUF files (Llama-style and similar) point to local LLM and embedding tooling such as Ollama. Safetensors show up where Hugging Face and PyTorch are in play, typical of conversation summarization, fine-tuned models, and the rest. PMML turns up for the older, traditional machine learning stack such as SAS, R, sklearn, and other analytics tools. So it isn’t only “someone ran Ollama”; it’s a mix of local LLMs, modern deep learning, and classical ML.

On the MCP side, the picture is just as busy. Almost 400 distinct named MCP servers show up consistently across millions of endpoints, and a smattering of one-off or niche servers that could warrant further investigation. The names that rise to the top read like a who’s-who of how business gets done and correlate to some of the most popular enterprise tooling on the market.

Those tools are unlikely to be “shadow AI,” but they are the tools teams are wiring into their AI-assisted workflows. The question for security and governance is whether that wiring is visible and appropriately monitored. Attackers will look for opportunities to masquerade and blend in with legitimate vendor tooling, so stay vigilant.

The real risk isn’t always “we have new AI tools in our organization.” It’s “we haven’t looked and validated the AI tools in our organization.” The gap between those two is where governance must be applied, and fast.

How Tanium helps

Without visibility into what AI tools are running, where they run, and how they’re configured, organizations can’t make informed governance or risk decisions.

Tanium Guardian Spotlight: AI Tools gives security teams a centralized, endpoint-level view of shadow AI across the environment.

The dashboard discovers and inventories:

  • Configured MCP servers: Count and type (HTTP, SSE, STDIO) of MCP servers in developer IDEs, plus which IDEs have them
  • Local model managers: Applications like Ollama, LM Studio, and GPT4All; usage over the last 90 days; and (with Index/SBOM) AppImage and container-based installs
  • AI model files: Distinct model files detected via Tanium Index (e.g. GGUF, SafeTensors), with path and naming context
  • OpenClaw: Endpoints with OpenClaw running, for assessment of exposure to its known risks

Teams can use the Executive Summary for scope, the MCP section to align servers with policy, and the usage trends to separate installed tools from tools in active use. Full capability uses Tanium Index, SBOM, Asset Software Inventory and Usage, and Threat Response.

For details, see the Guardian Spotlight: AI Tools Release Notes and the Tech Talk on AI Tools visibility and risk.

References

Shadow AI reports

MCP security

Threat intelligence

Local LLM detection

Supply chain

Miscellaneous–risky and malicious AI

AI risks and security