Anyone who looks only at which AI tools employees use misses the more expensive problem: shadow dev, where end users build entire applications with a handful of prompts and neither IT nor security ever looks at them.
By Anthony Raaijmakers
Shadow AI has been in the news all summer: employees using ChatGPT or Claude on their own initiative, out of sight of IT. Research by security compliance platform Vanta across more than 15,000 companies shows that 70 percent of organisations now have shadow AI in the building, meaning AI tools with access to company data that were never reviewed. But anyone who looks only at which tools employees use misses the more expensive problem: shadow dev, where end users build entire applications with a handful of prompts and neither IT nor security ever looks at them. That difference, between a tool someone uses and an application someone builds, determines how much risk an organisation is actually carrying.
AI tools have become so accessible this year that anyone reasonably handy with prompting can deliver a working application without understanding a single line of code. At the same time the conversation inside companies is shifting from "which tool am I allowed to use" to "what can I build myself", and that shift is moving faster than the governance around it can follow. Research by the Cloud Security Alliance (2 June 2026) concludes that none of the common AI safety frameworks, not NIST AI RMF, not OWASP LLM Top 10, not CSA MAESTRO, was designed for this group of builders.
Shadow AI on its own is already hard to control, and Vanta's figures show this is not about incidents but about scale. That is not because security teams are failing at their jobs, but because employees do not wait for the procedure to be finished.
I see shadow dev in two forms, and both are at least as hard to control. The first is exactly what the Cloud Security Alliance describes: apps built on platforms the organisation has already approved, such as Microsoft Power Platform or Salesforce. The platform is approved, the application is not, because nobody has ever seen that specific app.
The second form is more direct and starts on the device itself. Someone asks Claude or ChatGPT to build something, and to get it working half a development environment ends up on the company laptop: Node, Python packages, Docker, a CLI tool or two, and underneath them tens to hundreds of dependencies from public registries that nobody has ever reviewed. That is software installation on a corporate device without any vetting, precisely the supply chain that security does run scans on during regular development. The code is then pushed to a personal GitHub repo and is live on Vercel or Supabase within the hour, usually under a personal account. Nowhere in that chain is there a moment where IT could have known about it, let alone checked anything.
Where shadow AI mainly raises the question of which tools are running, shadow dev goes a step further: you no longer even know which employee has what running, on which laptop and under which account. And when something does go wrong, there is usually nobody who can explain how the thing works. In a study cited by the Cloud Security Alliance, 5,600 self-built AI applications were examined, and not one of them had CSRF protection, standard security headers or correctly configured access rights. Not because the builder was careless, but because nobody was checking that step.
This is exactly what we at Oneminded have been pointing out for a while: AI speeds up building, but it does not replace understanding what is being built. An application delivered with three prompts is not bad by definition. The problem starts when nobody can explain how it works, where the data goes, and what breaks when a vendor changes its API. We therefore see AI as scaffolding rather than as the end product: building faster, with engineers who know the foundations and can take responsibility when something goes wrong.
And because this often runs on real company data, the question is not whether AI is allowed to build, but who owns it afterwards: who knows the app, who manages the access, and who can still maintain it a year from now. That is no reason to slow down AI use, but every reason to organise it deliberately and with ownership instead of leaving it to loose prompts and personal cloud accounts.
Want to know what is already running inside your organisation without anyone knowing? Send us a message and we will happily think along, with no obligation.