Left running for a month, one forgotten 8 x H100 node is a $40,179 line item nobody budgeted for. That is shadow AI, and it is already on your infrastructure.
Somewhere in your cloud estate there is probably an instance tagged something like "llama-test". It was launched on a Friday by an engineer who wanted to see whether an open-weights model could summarise support tickets better than the vendor tool procurement is still evaluating. If it is a p5.48xlarge, it has eight NVIDIA H100s and an on-demand list price of $55.04 per hour in us-east-1. Left running for a month, that is $40,179 on a bill nobody budgeted for, sitting under a cost centre nobody will question until the quarter closes.
That instance is shadow AI. Not the version most security vendors describe, where an employee pastes a spreadsheet into a consumer chatbot, but the version that lands on your infrastructure: unsanctioned models, inference servers, API keys and data copies running inside accounts you pay for and are accountable for. This article maps where that footprint actually lives, what it costs, and how to find it in 30 days without shutting down the experimentation that produced it.
The usage data is no longer ambiguous. MIT Project NANDA's "The GenAI Divide: State of AI in Business 2025" found that workers at more than 90 percent of companies regularly use personal AI tools for work, while only 40 percent of companies had purchased official LLM subscriptions. Gartner reported in November 2025 that 69 percent of cybersecurity leaders it surveyed have evidence or suspicion of employees using public generative AI at work, and predicted that by 2030 more than 40 percent of organisations will suffer security or compliance incidents caused by unauthorised AI tools.
The breach data has caught up too. IBM's Cost of a Data Breach Report 2025 was the first edition to measure shadow AI directly. One in five organisations attributed a breach to it, and organisations with high levels of shadow AI paid an average of $670,000 more per breach than those with little or none. In shadow AI incidents, 65 percent involved compromised customer personally identifiable information (PII), against a 53 percent global average. Only 37 percent of organisations had policies to manage AI or detect shadow AI.
A note on sources, because this audience should apply it. IBM, Netskope and Gartner all sell products or advice that address the problem they are measuring. The direction of their findings is consistent across three independent methodologies (breach forensics, network telemetry and executive surveys), which is why we trust the trend. Treat any single headline number as an upper bound until your own logs confirm it.
What changed in 2026 is where the activity runs. Two years ago shadow AI meant a browser tab. Today a developer can pull a 70 billion parameter model onto a GPU instance in minutes, wire an agent to a production database through a Model Context Protocol (MCP) server, or put a provider API key on a corporate card and call it from a cron job. Each of those leaves a footprint in your billing data, your network logs and your storage, which is exactly why infrastructure teams, not just security teams, are now the ones best placed to find it.
Shadow AI is not one thing. It shows up in four distinct layers, and each one leaves a different signal. Mapping your estate against these layers is the fastest way to stop arguing about whether the problem exists and start measuring it.
| Layer | Where it shows up | Main risk | First detection signal |
|---|---|---|---|
| Personal accounts and SaaS | Network and SaaS logs | Data uploaded to unmanaged tools | DNS and proxy logs |
| Unsanctioned API keys | Expense reports, company code | Untracked spend, data leaving via code | Card data, repo secret scans |
| Self-hosted models | GPU instances, containers | Exposed endpoints, LLMjacking | GPU cost data, open port 11434 |
| Agents and connectors | MCP servers, workflow tools | Over-privileged production access | Audit logs, credential inventory |
This is the layer everyone talks about. Netskope's Cloud and Threat Report 2026 found that 47 percent of generative AI users still access tools through personal, unmanaged accounts. The encouraging part is the trend: that figure was 78 percent a year earlier, and the share of users on organisation-managed accounts climbed from 25 percent to 62 percent. Provisioning a sanctioned tool works. The discouraging part is volume: the number of people using SaaS generative AI apps tripled in the average organisation over the same period.
A team signs up for a model provider API, expenses the bill, and calls it from a service running in your production account. The model is external, but the data, the code path and the credentials live on your infrastructure. This layer hides in expense reports rather than cloud bills, which is why FinOps teams that only reconcile the cloud invoice never see it.
Open-weights models plus tools like Ollama, Open WebUI, Flowise and Langflow make it trivial to stand up a private inference endpoint. The trouble is that several of these tools ship without authentication by default. When one of them is launched on a cloud instance with a permissive security group, your GPU becomes a public service.
The newest layer and the highest blast radius. An agent connected through an MCP server or a workflow tool inherits whatever credentials it was given. Netskope flags unattended AI activity as a growing category that must be visible in logs and policy engines. When the agent was never approved, nobody has scoped those credentials, and the first sign of trouble can be an incident rather than an alert.
Layer 3 deserves its own section because attackers have already industrialised it. A Cloud Security Alliance (CSA) research note published in May 2026, drawing on an internet-wide survey by Intruder, found that 31 percent of more than 5,200 directly queried Ollama API servers answered unauthenticated test prompts. That is 1,652 servers willing to run arbitrary requests for anyone. The same survey found more than 12,000 Open WebUI instances, 2,650 Flowise deployments and 300 Langflow servers exposed, some revealing full agentic workflows, credential stores and plaintext API keys.
This is not passive exposure. The CSA note reports that GreyNoise captured 91,403 sessions targeting Ollama endpoints between October 2025 and January 2026 across two distinct campaigns. It also documents CVE-2026-7482, a critical vulnerability rated CVSS 9.1 that researchers at Cyera named "Bleeding Llama", which exploits the lack of default authentication to exfiltrate data from publicly reachable instances.
For an infrastructure buyer the implication is concrete. An exposed endpoint on your GPU is an open invitation for LLMjacking, the practice of running someone else's inference workload on infrastructure you pay for. It is also a data leak, because model servers hold prompts, cached context and sometimes the keys to everything else the experimenter connected.
Breach statistics get the headlines, but the cost most organisations pay first is plain waste. Unsanctioned AI spend is invisible to the controls built for sanctioned spend: it carries no tags, has no budget owner, and rarely sits in an account with anomaly alerts tuned for GPU instance families. The worked examples below use current AWS list prices and are deliberately conservative.
A p5.48xlarge lists at $55.04 per hour on demand in us-east-1, after AWS cut P5 on-demand pricing in June 2025. A single node left running from Friday evening to Monday morning (64 hours) costs $3,522.56. Left running for a 730 hour month, it costs $40,179.20. Compare that rate with what the same eight H100s cost on a 1-year commitment, or with neocloud pricing on the GPU Price Explorer, and the waste compounds: shadow workloads always run at the most expensive purchase option because nobody negotiated anything.
A team copies 50 TB of support transcripts out of Amazon S3 to a GPU provider to fine-tune a model without going through procurement. At S3 internet data transfer rates of $0.09 per GB for the first 10 TB and $0.085 per GB for the next 40 TB, that single copy costs roughly $4,403 in egress. The dataset now also exists, ungoverned, in a third environment. This is the GPU and storage connection we keep returning to: every compute decision drags data with it, and egress turns an experiment into a recurring liability the moment someone decides to retrain.
A cheaper token is not a cheaper bill. As model prices fall, teams wire agents into more workflows, and agentic workloads consume far more tokens than chat. When those calls run through a key on an expense report, the spend never reaches the AI cost dashboards FinOps built for Amazon Bedrock, Vertex AI or Azure AI. The organisation ends up underestimating its true AI spend precisely when it is trying to forecast it.
| Scenario | Assumption | Rate | Cost |
|---|---|---|---|
| GPU node, one weekend | p5.48xlarge, 64 hours | $55.04/hr | $3,522.56 |
| GPU node, one month | p5.48xlarge, 730 hours | $55.04/hr | $40,179.20 |
| Dataset copy for fine-tune | 50 TB out of S3 to internet | $0.09/GB first 10 TB, $0.085/GB next 40 TB | $4,403.20 |
Storage is where shadow AI does its longest-lasting damage. Every unsanctioned project produces artefacts: copied training sets, embeddings in an unapproved vector store, model checkpoints in a personal bucket, logs full of prompts. Netskope found that source code accounts for 42 percent of AI-related data policy violations, regulated data for 32 percent and intellectual property for 16 percent. Those are the same categories that end up in the artefacts.
IBM found that 62 percent of shadow AI incidents affected data stored across multiple environments and public clouds. That is data gravity working against you: once data lands in an environment you did not choose, it pulls compute, retention obligations and egress bills after it. Governing shadow AI is therefore partly a storage architecture decision. Give teams a sanctioned, S3-compatible bucket with predictable or zero egress pricing, such as Backblaze B2, Wasabi or Cloudflare R2, positioned next to approved GPU capacity, and the incentive to copy data somewhere else drops sharply.
The contrarian point the evidence supports: blocking does not work, and it destroys value. The MIT NANDA study found that shadow AI often delivers better return on investment than formal enterprise AI initiatives, because employees pick tools that actually fit their work. Ban those tools and the activity moves to personal devices and hotspots, where you lose even the network telemetry.
Netskope's own trend data shows what does work. Personal account use fell from 78 percent to 47 percent in a single year as organisations provisioned managed alternatives. The pattern from shadow IT repeats: people route around friction, so the fix is to make the sanctioned path faster than the shadow one. Treat every shadow AI discovery as a requirements document you did not have to write.
This sequence assumes no new tooling. Each week produces a list you can act on, and the order goes from cheapest signal to most invasive.
You cannot govern what you cannot see, and in 2026 the clearest view of shadow AI is not in a security console. It is in your bill.
Compare AWS, Google Cloud, Azure, and alternatives like Backblaze B2 Discover how much you could save in seconds
