Skip to navigation

Threat reportThreat IntelligenceTL-2026-1735

Netskope "Beyond Shadow AI" Report: Shadow AI Data Exposure Escalates as Agentic AI/MCP Governance Lags Enterprise Adoption

mediumACTIVE

Netskope's "Beyond Shadow AI" report (telemetry window: October 2024 - October 2025) finds organization-managed GenAI account usage rose from 25% to 62% year-over-year, yet GenAI data-policy violations doubled to roughly 223 incidents per organization per month, driven mainly by source code (42%), regulated data (32%), and intellectual property (16%) leakage.

Key facts for Netskope Beyond Shadow AI report

IdentifiersTL-2026-1735
Also known asBeyond Shadow AI: The Netskope AI Report
SeverityMEDIUM
Exploitation statusNo known exploitation
ToolsChatGPT, Google Gemini, Microsoft 365 Copilot
MITRE ATT&CK techniquesT1005 Data from Local System, T1027 Obfuscated Files or Information, T1036 Masquerading, T1048 Exfiltration Over Alternative Protocol, T1059 Command and Scripting Interpreter, T1071 Application Layer Protocol, T1078 Valid Accounts, T1102 Web Service, T1119 Automated Collection, T1134 Access Token Manipulation, T1195 Supply Chain Compromise, T1199 Trusted Relationship and 10 more in the attack flow
MotivationUNKNOWN
Target regionsGlobal
Detection rules9 (1 shown free)
Sources17 cited sources

Detection coverage for Netskope Beyond Shadow AI report

As of 2026-07-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1735 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Shadow AI Exfiltration — Sensitive Data POSTed to Personal/Unmanaged GenAI Endpoint

Detects users submitting source-code, regulated data (PII/PHI/financial), or intellectual-property-tagged content via HTTP POST to a generative-AI web destination while authenticated with a personal/unmanaged account rather than an org-managed, SSO-integrated session — the primary pattern behind Netskope's ~223 monthly GenAI DLP violations per organization (42% source code, 32% regulated data, 16% IP).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1567, T1078, T1204
  • Data sources: netskope_casb, zscaler_proxy, web_proxy_logs, dlp_logs
  • Severity: high
  • Confidence: high

Splunk SPL

index=casb OR index=proxy sourcetype IN ("netskope:page","zscaler:web","proxy:web") dst_category="generative-ai" http_method=POST
| eval account_type=coalesce(account_type, ccl_account_type, "unknown")
| where account_type IN ("personal","unmanaged","byoai")
| eval dlp_hit=if(match(dlp_profile, "(?i)source[-_ ]?code|regulated[-_ ]?data|pii|phi|intellectual[-_ ]?property"), 1, 0)
| where dlp_hit=1
| eval app_name=coalesce(app_name, dst_host)
| stats count as violation_count, sum(bytes_out) as total_bytes_out, min(_time) as first_seen, max(_time) as last_seen, values(dlp_profile) as dlp_categories by user, src_ip, app_name
| where violation_count >= 1
| sort - violation_count

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor in ("Netskope","Zscaler","McAfee","Broadcom") and DeviceEventClassID has "generative-ai"
| where RequestMethod == "POST"
| extend AccountType = tostring(parse_json(AdditionalExtensions).account_type)
| where AccountType in ("personal","unmanaged","byoai")
| extend DlpProfile = tostring(parse_json(AdditionalExtensions).dlp_profile)
| where DlpProfile has_any ("source-code","regulated-data","pii","phi","intellectual-property")
| summarize ViolationCount=count(), TotalBytesOut=sum(toint(SentBytes)), Apps=make_set(DestinationHostName), Profiles=make_set(DlpProfile) by SourceUserName, SourceIP
| where ViolationCount >= 1
| order by ViolationCount desc

Sigma

title: Shadow AI Exfiltration - Sensitive Data POSTed to Personal GenAI Endpoint
id: 6f1e2a4a-2f1b-4b7a-9c3d-1a2b3c4d5e01
status: experimental
description: Detects sensitive-data (source code, regulated data, IP) POST requests to generative-AI web destinations from personal/unmanaged accounts, bypassing org DLP/CASB visibility.
references:
    - https://www.netskope.com/blog/beyond-shadow-ai-the-netskope-ai-report
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-28
tags:
    - attack.exfiltration
    - attack.t1567
    - attack.initial-access
    - attack.t1078
tags_note: attack.t1078.004 sub-technique refers to cloud accounts (personal/shadow GenAI credentials)
logsource:
    category: proxy
    product: casb
detection:
    selection:
        dst_category: 'generative-ai'
        account_type: 'personal|unmanaged|byoai'
        http_method: 'POST'
        content_type|contains:
            - 'text/plain'
            - 'application/json'
    dlp_hit:
        dlp_profile|contains:
            - 'source-code'
            - 'regulated-data'
            - 'pii'
            - 'phi'
            - 'intellectual-property'
    filter_managed:
        account_type: 'organization-managed'
    condition: selection and dlp_hit and not filter_managed
fields:
    - user
    - dst_host
    - bytes_out
    - dlp_profile
falsepositives:
    - Approved pilot program temporarily using personal accounts before SSO migration completes
    - DLP profile misclassification of public documentation content
level: high

Known false positives:

  • Approved pilot program temporarily using personal accounts before SSO migration completes
  • Legitimate research use of public GenAI documentation pages misclassified as a dlp_profile hit

Tuning notes: Tune the dlp_profile / DlpProfile regex to match your CASB's actual DLP category taxonomy; exclude any approved personal-account pilot users via an allow-list lookup to avoid alert fatigue during SSO migration windows.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Shadow AI Account-Switching Evasion — Personal/Managed GenAI Session Alternation · unlock with TL Creds
  • MCP Confused-Deputy Privilege Escalation — OAuth Token Reused Across Distinct Users · unlock with TL Creds
  • MCP Agent-Message Exfiltration to Attacker-Controlled Endpoint Post-Update · unlock with TL Creds
  • Sensitive Data Pasted to Personal/Unmanaged GenAI Web Endpoint · unlock with TL Creds
  • MCP Tool Shadowing / Typosquatting Detected in Tool Registry · unlock with TL Creds
  • MCP-Adjacent Package Version Change Alters Outbound Network Behavior (Supply-Chain Rug Pull) · unlock with TL Creds
  • MCP Tool Manifest Poisoning — Hidden Instruction in Tool Description/Schema · unlock with TL Creds
  • MCP/npm-Style Supply-Chain Rug Pull — Package Update Followed by New Outbound Egress · unlock with TL Creds

Indicators of compromise for Netskope Beyond Shadow AI report

As of 2026-07-28, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-1735.

22 indicators of compromise · unlock with TL Creds. Compare plans

How Netskope Beyond Shadow AI report works

The report also flags agentic AI and the Model Context Protocol (MCP) as an under-governed emerging attack surface, with only 8% of organizations reporting any MCP governance policy.

Netskope's "Beyond Shadow AI" report analyzes telemetry from its Security Cloud customer base over an October 2024-October 2025 window and finds a mixed security picture for enterprise generative-AI (GenAI) adoption. On the positive side, the share of GenAI users on company-approved, organization-managed accounts rose sharply from 25% to 62% year-over-year, while personal, unmanaged-account usage fell from 78% to 47%. A residual 9% of users (up from 4% the prior year) actively switch between personal and enterprise accounts for the same GenAI tools, undermining the value of managed-account controls by giving users an easy escape hatch from monitored channels.

Despite that account-management progress, GenAI data-policy violations doubled year-over-year, with the average organization recording approximately 223 violations per month, committed by roughly 3% of users. The three most common categories of leaked data were source code (42% of violations), regulated data such as PII/PHI/financial records (32%), and intellectual property (16%). Netskope names ChatGPT, Google Gemini, and Microsoft 365 Copilot as the GenAI tools most frequently accessed through personal, non-organizational credentials, stating: "A substantial share of employees are relying on tools such as ChatGPT, Google Gemini and Copilot, using credentials not associated with their organization." Netskope's own recommendation is that enterprises pair "clearer policies, better provisioning, and ongoing visibility into how AI tools are actually being used" rather than relying on blocking alone, since employee behavior is consistently outpacing governance policy.

The report separately identifies agentic AI and the Model Context Protocol (MCP) - the emerging standard integration layer that lets LLM-based agents call external tools, APIs, and data sources - as an escalating, largely ungoverned attack surface: only 8% of organizations report having any policy governing MCP use at all. This finding is corroborated by independent security research: Checkmarx documents concrete MCP-specific attack techniques including tool poisoning (hidden malicious logic embedded in tool descriptions/schemas), confused-deputy privilege escalation (MCP servers acting on a user's behalf without properly verifying authorization, enabling cross-user access via OAuth token reuse), supply-chain "rug pull" attacks (a previously trustworthy MCP server or dependency turning malicious via an update), tool shadowing/typosquatting, and context/resource poisoning of shared agent state. Cisco's AI Threat Intelligence and Security Research group (reported via Help Net Security, 2026-02-23) found only 29% of organizations feel prepared to secure agentic AI deployments, an 92% success rate for multi-turn prompt-injection/jailbreak attacks across eight tested open-weight models, and documented a real-world case of a fake npm package used in an MCP-adjacent supply chain to copy outbound agent messages to an attacker-controlled address; the same research noted China-linked threat actors have automated an estimated 80-90% of an attack chain using jailbroken AI coding assistants.

In response to the governance gap, Netskope has begun extending its own platform (Netskope One) with MCP-specific controls - Cloud Confidence Index risk scoring for MCP servers, a default-block option for unapproved MCP traffic, least-privilege access restriction for AI agents, DLP inspection of MCP traffic for IP/credential leakage, and detailed logging of MCP sessions, tool calls, and responses - per Chief Product Officer John Martin. At the regulatory level, CISA, the NSA, and the cyber agencies of Australia, Canada, New Zealand, and the UK jointly published "Careful Adoption of Agentic AI Services" on 2026-05-01, the first coordinated multinational guidance on agentic AI risk, defining five risk categories (privilege escalation, design/configuration failures, behavioral misalignment, structural brittleness, and accountability gaps) and calling for cryptographically anchored, short-lived credentials for every autonomous agent. The findings track closely with the OWASP Top 10 for LLM Applications categories LLM05 (Supply Chain Vulnerabilities), LLM06 (Sensitive Information Disclosure), and LLM08 (Excessive Agency).

This is a threat-landscape/governance report rather than a specific exploited vulnerability - no CVE or CVSS score applies - but it is tracked because it quantifies an active, organization-wide data-exposure risk (shadow AI usage plus an emerging, near-ungoverned agentic-AI/MCP attack surface) directly relevant to SOC risk posture, DLP tuning, and enterprise AI governance policy.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1119 Automated Collection; T1213 Data from Information Repositories

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading

Exfiltration

T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1102 Web Service

Initial Access

T1078 Valid Accounts; T1195 Supply Chain Compromise; T1199 Trusted Relationship

Privilege Escalation

T1134 Access Token Manipulation; T1548 Abuse Elevation Control Mechanism

Lateral Movement

T1210 Exploitation of Remote Services

Discovery

T1518 Software Discovery; T1526 Cloud Service Discovery

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

Persistence

T1554 Compromise Host Software Binary

Remediation for Netskope Beyond Shadow AI report

Patches

  • Apply MCP client/server and AI-agent framework updates promptly, but validate signing/provenance given documented supply-chain 'rug pull' and fake-package incidents (e.g., the fake npm package cited by Cisco AI Threat Intelligence)

Immediate actions

  • Deploy CASB/DLP controls to detect and block sensitive data (source code, regulated data, intellectual property) being pasted into personal/unmanaged GenAI accounts such as ChatGPT, Gemini, or Copilot
  • Default-block unapproved MCP (Model Context Protocol) server traffic pending explicit security review and approval, mirroring Netskope's default-block MCP control model
  • Inventory all sanctioned and shadow GenAI applications and MCP servers/clients currently reachable from the corporate network and by autonomous agents

Workarounds

  • Restrict AI agent/MCP tool permissions to least privilege and disable auto-approval of new MCP tool/server connections
  • Require human-in-the-loop approval for AI agent actions that touch production systems, source-code repositories, or regulated data stores

Longer-term hardening

  • Establish a formal MCP governance policy - currently only 8% of organizations report having one - covering approved servers, least-privilege tool scoping, and change control for MCP server updates
  • Adopt cryptographically anchored, short-lived credentials for autonomous AI agents per the CISA/NSA/Five Eyes 'Careful Adoption of Agentic AI Services' guidance (2026-05-01)
  • Migrate employees from personal GenAI accounts to organization-managed, SSO-integrated accounts to restore audit trail and DLP coverage, closing the 9% personal/enterprise account-switching gap
  • Implement continuous behavioral monitoring for AI agent tool calls, session initializations, and MCP data-source access, consistent with OWASP LLM08 (Excessive Agency) guidance

Timeline of Netskope Beyond Shadow AI report

  • locked-ioc-18's 'Beyond Shadow AI' report begins its telemetry collection window, tracking enterprise GenAI and shadow AI usage patterns across the locked-ioc-18 Security Cloud customer base.
  • locked-ioc-17 publicly introduces and open-sources the locked-ioc-9 with Python/TypeScript SDKs, the agent-to-tool integration standard that this report and subsequent research (Checkmarx) later identify as a near-ungoverned enterprise attack surface.
  • The locked-ioc-11 publishes the MAESTRO agentic-AI threat modeling framework (seven-layer architecture covering foundation model, data, deployment, observability, security, compliance, and agent ecosystem), establishing the risk taxonomy later echoed by locked-ioc-21/locked-ioc-22 agentic AI guidance.
  • The locked-ioc-11 releases its Agentic AI Red Teaming Guide, defining 12 agentic-specific threat categories (permission escalation, orchestration flaws, memory manipulation, supply-chain risk) beyond the OWASP LLM Top 10.
  • Telemetry collection window for the report closes; year-over-year figures (25%->62% managed accounts, 78%->47% personal accounts, 4%->9% account-switching) compare this period against the prior 12 months.
  • Checkmarx publishes '11 Emerging AI Security Risks with MCP,' documenting the tool poisoning, confused-deputy privilege escalation, supply-chain rug-pull, and tool shadowing/typosquatting attack techniques corroborating this threat's agentic-AI attack surface findings.
  • SecurityBrief Australia reports that locked-ioc-18 has placed new MCP-specific governance controls (Cloud Confidence Index risk scoring, default-block for unapproved MCP traffic, DLP inspection of MCP sessions) into customer preview, with general availability expected in H1 2026.
  • locked-ioc-13 and locked-ioc-19 independently publish corroborating coverage of locked-ioc-18's findings, quoting the report directly on the managed-account shift and ~223 monthly GenAI data policy violations per organization.
  • A GRC-focused analysis of locked-ioc-18's report is published, additionally citing that GenAI user counts tripled year-over-year and that the top quartile of organizations send more than 70,000 GenAI prompts per month.
  • Help Net Security reports Cisco AI Threat Intelligence and Security Research findings that only 29% of organizations feel prepared to secure agentic AI deployments and that multi-turn prompt-injection/jailbreak attacks succeeded 92% of the time across eight tested open-weight models, reinforcing the MCP governance gap locked-ioc-18's report identifies.
  • A locked-ioc-11 / Aembit study finds more than two-thirds (68%) of organizations cannot clearly distinguish AI agent actions from human actions in audit logs, and that 74% of AI agents are provisioned with more permissions than their tasks require, compounding the visibility gap locked-ioc-18's report identifies for shadow AI and MCP usage.
  • A locked-ioc-11 / Token Security survey of 418 IT and security professionals finds 82% of enterprises have unknown AI agents operating in their environments and 65% experienced an AI-agent-related incident in the prior 12 months (61% data exposure, 43% operational disruption, 35% financial loss), reinforcing the asset-blindness risk cited in the CSA shadow-AI whitepaper referenced in this threat's sources.
  • locked-ioc-21, the locked-ioc-22, and the cyber agencies of Australia, Canada, New Zealand, and the UK jointly publish 'Careful Adoption of Agentic AI Services,' the first coordinated multinational guidance on agentic AI risk, defining five risk categories and calling for cryptographically anchored, short-lived agent credentials.

Sources cited for Netskope Beyond Shadow AI report

Showing 15 of 17 sources, primary sources first.

Previous and next in threat intel

Drafted by the Threadlinqs research pipeline from 17 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats