Shadow AI is no longer a handful of employees pasting text into a public chatbot. In 2026, unsanctioned AI usage has metastasized into a sprawling, multi-vector problem: local large language models running on developer workstations, AI coding assistants with broad filesystem and repository access, browser extensions that read every page an employee visits, and autonomous agents making API calls on behalf of users with little to no oversight. As Tenable highlights in its recent Cybersecurity Awareness Month analysis, shadow AI now spans a broad spectrum of asset types across the environment — and that diversity is precisely what makes it hard to detect and control.
For defenders, the risk is concrete and measurable. Every unsanctioned AI tool is an unmonitored egress point for sensitive data: source code pasted into an external LLM API, patient or cardholder data summarized by an unapproved assistant, credentials and internal architecture documents fed into a local model with internet-connected plugins, or an autonomous agent exfiltrating files because nobody scoped its permissions. Traditional DLP and proxy controls were not designed for these patterns. If your security program still treats shadow AI as 'block ChatGPT at the firewall,' you are defending against a 2023 threat model.
This post breaks down the modern shadow AI attack surface, provides production-ready detection logic for the most common shadow AI vectors, and lays out a governance and remediation framework you can operationalize this quarter.
Technical Analysis: The Modern Shadow AI Attack Surface
Shadow AI in 2026 manifests across at least five distinct vector classes, each with different observability characteristics:
1. SaaS AI chatbots and web platforms. The original vector — employees using unapproved web-based LLM services. Observable via DNS, proxy, and CASB telemetry. Increasingly difficult to control because legitimate business tools now embed third-party AI features that call the same backend APIs.
2. AI browser extensions. Extensions with read and change all your data on all websites permissions that silently send page content, form data, and session context to external inference endpoints. These bypass network DLP because the data leaves via the browser's own HTTPS session, blended into normal web traffic.
3. Local LLM runtimes. Tools like Ollama, LM Studio, llama.cpp, and GPT4All let employees run models entirely on-device. Ollama, for example, binds a REST API to TCP port 11434 by default — and we've repeatedly found it bound to 0.0.0.0 on developer machines and even servers, exposing an unauthenticated model API (and any loaded data context) to the entire network. Local models also sidestep every network control you have: no proxy log, no CASB event, no DLP trigger.
4. AI coding assistants and IDE plugins. Copilot-class tools and unvetted IDE extensions with access to entire source trees, environment files, and shell history. From a data-security perspective, these are functionally insider endpoints with read access to your crown-jewel repositories, sending context to third-party inference APIs.
5. Autonomous AI agents. Agent frameworks that chain tool calls — reading files, querying databases, sending email, executing code — under delegated user credentials. An unsanctioned agent running with a developer's OAuth tokens is indistinguishable from the developer in most logs, which is exactly the problem.
Why Traditional Controls Fail
- Network controls miss local models and browser-extension traffic that rides inside legitimate HTTPS sessions to otherwise benign domains.
- DLP signatures tuned for file uploads miss chunked prompt payloads and API-based context sharing.
- Application allowlists fail when AI capability is embedded inside sanctioned software.
- IAM controls break down when agents act under user-delegated tokens, creating attribution ambiguity that IR teams will feel acutely during an investigation.
The defensive implication is clear: shadow AI containment requires layered discovery — endpoint process telemetry, network connection baselining, browser extension inventory, and identity analytics — plus governance that gives employees a sanctioned path so they stop routing around you.
Detection & Response
The detections below target the highest-fidelity, lowest-noise indicators of shadow AI presence: local LLM runtimes and their default API listeners, execution of known AI tooling binaries, and outbound connections to AI inference endpoints. Tune the filter blocks to your sanctioned AI inventory — that inventory is the foundation everything else builds on.
Sigma Rules
---
title: Local LLM Runtime Execution Detected
id: 3f8a2c14-7b1d-4e59-9a36-2c8d5f0a1b7e
status: experimental
description: Detects execution of common local LLM runtimes (Ollama, LM Studio, llama.cpp, GPT4All) which may indicate shadow AI usage outside sanctioned AI governance.
references:
- https://www.tenable.com/blog/how-to-contain-shadow-ai-as-it-takes-on-multiple-forms-and-spreads-throughout-your-environment
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\ollama.exe'
- '\ollama app.exe'
- '\LM Studio.exe'
- '\llama-server.exe'
- '\llama-cli.exe'
- '\main.exe'
- '\gpt4all.exe'
- '\chat.exe'
selection_cli:
CommandLine|contains:
- 'ollama serve'
- 'ollama run '
- 'ollama pull '
- 'llama-server'
- '--model'
condition: selection_img or selection_cli
falsepositives:
- Sanctioned local AI development — maintain an approved-user/approved-host allowlist and suppress via filter
level: medium
---
title: Ollama API Listener Bound to All Interfaces
id: 9e4b7d21-3a6f-4c82-b518-7d0e2a9c4f35
status: experimental
description: Detects Ollama serving its unauthenticated REST API bound to 0.0.0.0, exposing loaded models and context to the network — a common shadow AI misconfiguration on developer workstations and servers.
references:
- https://www.tenable.com/blog/how-to-contain-shadow-ai-as-it-takes-on-multiple-forms-and-spreads-throughout-your-environment
author: Security Arsenal
date: 2026/01/15
tags:
- attack.command_and_control
- attack.t1571
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- 'OLLAMA_HOST=0.0.0.0'
- 'OLLAMA_HOST=0.0.0.0:11434'
selection_env:
Image|endswith: '\ollama.exe'
CommandLine|contains: 'serve'
condition: selection
falsepositives:
- Sanctioned shared inference servers — should be inventoried and network-restricted regardless
level: high
---
title: AI Assistant Process Spawned on Linux or macOS
id: 5c1d8e42-9f3a-4b67-a824-1e6c3d8f2a91
status: experimental
description: Detects execution of local LLM runtimes and AI CLI agents on Linux/macOS systems, indicating potential unsanctioned AI tooling.
references:
- https://www.tenable.com/blog/how-to-contain-shadow-ai-as-it-takes-on-multiple-forms-and-spreads-throughout-your-environment
author: Security Arsenal
date: 2026/01/15
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith:
- '/ollama'
- '/llama-server'
- '/llama-cli'
- '/text-generation-webui'
CommandLine|contains:
- 'ollama serve'
- 'ollama run '
- 'llama-server'
condition: selection
falsepositives:
- Approved ML engineering workloads — suppress known build/inference hosts
level: medium
KQL — Microsoft Sentinel / Defender Hunting
This query hunts for devices establishing outbound connections to well-known AI inference endpoints and for processes matching local LLM runtime names. Run it over 14 days to build a shadow AI inventory, then convert unsanctioned hits into an outreach and remediation queue rather than an immediate block — understanding why employees adopted the tool is half the containment strategy.
// Shadow AI discovery: AI API egress + local LLM runtimes
let AIEndpoints = dynamic([
"api.openai.com", "api.anthropic.com", "generativelanguage.googleapis.com",
"api.cohere.ai", "api.mistral.ai", "api.groq.com", "openrouter.ai",
"api.perplexity.ai", "api.x.ai", "api.deepseek.com", "copilot-proxy.githubusercontent.com"
]);
let AIRuntimeNames = dynamic([
"ollama.exe", "ollama", "llama-server", "llama-cli",
"LM Studio.exe", "gpt4all.exe", "text-generation-webui"
]);
let Sanctioned = externaldata(DeviceName: string) [h"https://your-storage.blob.core.windows.net/inventory/sanctioned-ai-hosts.csv"] with (format="csv", ignoreFirstRecord=true);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl in~ (AIEndpoints)
| project TimeGenerated, DeviceName, InitiatingProcessName, RemoteUrl, RemotePort, Vector="AI API Egress"),
(DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ (AIRuntimeNames) or ProcessCommandLine has_any ("ollama serve", "ollama run", "llama-server")
| project TimeGenerated, DeviceName, InitiatingProcessName=FileName, RemoteUrl="", RemotePort=0, Vector="Local LLM Runtime"),
(CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationHostName in~ (AIEndpoints)
| project TimeGenerated, DeviceName=SourceHostName, InitiatingProcessName=ApplicationProtocol, RemoteUrl=DestinationHostName, RemotePort=DestinationPort, Vector="Proxy/Firewall AI Egress")
)
| where DeviceName !in~ (Sanctioned)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), HitCount=count(), Vectors=make_set(Vector), Endpoints=make_set(RemoteUrl), Processes=make_set(InitiatingProcessName) by DeviceName
| order by HitCount desc
Velociraptor VQL — Endpoint Hunt
Deploy this artifact across your fleet to enumerate local AI runtimes, their model caches (which reveal what data was pulled locally), and listening ports — the forensic footprint of shadow AI on endpoints.
-- Hunt for shadow AI artifacts: runtimes, model caches, and LLM API listeners
SELECT * FROM foreach(row={
SELECT Name, Pid, Exe, CommandLine, Username
FROM pslist()
WHERE Exe =~ '(?i)(ollama|llama-server|llama-cli|lm studio|gpt4all|text-generation)'
OR CommandLine =~ '(?i)(ollama serve|ollama run|llama-server)'
}, query={
SELECT Name, Pid, Exe, CommandLine, Username,
'Running AI Runtime' AS Artifact
FROM scope()
})
-- Enumerate Ollama/llama.cpp model caches to size local AI footprint
SELECT FullPath, Size, Mtime
FROM glob(globs=[
'C:/Users/*/.ollama/models/manifests/**',
'C:/Users/*/.cache/lm-studio/models/**',
'C:/Users/*/.cache/gpt4all/**',
'/home/*/.ollama/models/manifests/**',
'/Users/*/.ollama/models/manifests/**'
])
-- Find unauthenticated LLM API listeners (default Ollama port 11434, LM Studio 1234, text-gen-webui 5000)
SELECT Name, Pid, Laddr, Lport, Status
FROM netstat()
WHERE Lport in (11434, 1234, 5000, 8080, 4891)
AND Status = 'LISTEN'
Remediation / Audit Script
This PowerShell audit script inventories shadow AI indicators on a Windows endpoint: installed runtimes, model caches, listening LLM API ports, and risky AI browser extensions in Edge and Chrome. Run it via your RMM or as a scheduled discovery task, and feed results to your exposure management platform.
# Shadow AI endpoint audit — run as SYSTEM or admin via RMM
# Outputs JSON findings for ingestion into SIEM/exposure management
$findings = @()
# 1. Check for local LLM runtime listeners
$llmPorts = 11434, 1234, 5000, 4891
foreach ($port in $llmPorts) {
$conn = Get-NetTCPConnection -LocalPort $port -State Listen -ErrorAction SilentlyContinue
if ($conn) {
foreach ($c in $conn) {
$proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
$findings += [pscustomobject]@{
Type = 'LLM_API_Listener'; Port = $port
Address = $c.LocalAddress; Process = $proc.ProcessName
Path = $proc.Path; User = $proc.StartInfo.UserName
}
}
}
}
# 2. Check for model caches per user profile
$cachePaths = @('.ollama', '.cache
m -rf lm-studio', '.cache
m -rf gpt4all', 'AppData
m -rf Local
m -rf LM Studio')
foreach ($profile in (Get-ChildItem 'C:
m -rf Users' -Directory -ErrorAction SilentlyContinue)) {
foreach ($rel in $cachePaths) {
$p = Join-Path $profile.FullName $rel
if (Test-Path $p) {
$size = (Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue | Measure-Object Length -Sum).Sum
$findings += [pscustomobject]@{
Type = 'AI_Model_Cache'; Path = $p
SizeMB = [math]::Round($size/1MB,1); User = $profile.Name
}
}
}
}
# 3. Inventory browser extensions with broad host permissions (Edge + Chrome)
$extRoots = @(
"$env:LOCALAPPDATA
m -rf Microsoft
m -rf Edge
m -rf User Data
m -rf Default
m -rf Extensions",
"$env:LOCALAPPDATA
m -rf Google
m -rf Chrome
m -rf User Data
m -rf Default
m -rf Extensions"
)
foreach ($root in $extRoots) {
if (Test-Path $root) {
Get-ChildItem $root -Directory -ErrorAction SilentlyContinue | ForEach-Object {
$manifest = Get-ChildItem $_.FullName -Recurse -Filter 'manifest.json' -ErrorAction SilentlyContinue | Select-Object -First 1
if ($manifest) {
try {
$m = Get-Content $manifest.FullName -Raw | ConvertFrom-Json
$perms = @($m.permissions) + @($m.host_permissions)
if ($perms -match '<all_urls>|\*://\*/\*|tabs|webRequest') {
$findings += [pscustomobject]@{
Type = 'Broad_Permission_Extension'
ExtensionId = $_.Name; Name = $m.name
Permissions = ($perms -join ';')
}
}
} catch {}
}
}
}
}
$findings | ConvertTo-Json -Depth 4
# Review output, cross-reference against your sanctioned AI inventory,
# and route unsanctioned findings to user outreach before enforcement.
Remediation: A Containment Framework That Actually Works
Blocking alone fails against shadow AI — it drives usage to personal devices and cellular hotspots where you have zero visibility. Containment requires governance, exposure management, and training working together:
1. Build and maintain a sanctioned AI inventory first. Publish an approved tools list with clear data-classification rules (what data may be pasted where). Shadow AI thrives in a vacuum; remove the vacuum. As Tenable's guidance emphasizes, integrate shadow AI scenarios into security awareness training so employees can recognize risk — and critically, foster open communication about why employees reach for unsanctioned tools. The answer usually points to a capability gap you can fill with a sanctioned alternative.
2. Discover continuously via exposure management. Treat unsanctioned AI assets like any other exposed asset class. Sweep endpoints monthly with the audit script above, baseline egress to AI inference endpoints, and inventory browser extensions with broad host permissions across the fleet. Feed discoveries into your attack surface management workflow with owner attribution.
3. Harden the known-bad configurations. Local LLM APIs (Ollama's 11434, LM Studio's 1234, text-generation-webui's 5000) ship unauthenticated by default. Where local AI is sanctioned, require binding to localhost only, place a reverse proxy with authentication in front of any shared inference server, and firewall the ports from lateral network access.
4. Control the browser layer. Deploy enterprise browser extension allowlisting via Chrome/Edge ADMX policies. Extensions requesting <all_urls> plus native messaging should require security review. This closes the vector that most easily bypasses network DLP.
5. Govern agents and delegated credentials. Require that any AI agent acting on corporate systems use scoped, short-lived service credentials — never a user's full OAuth token set. Log agent-initiated actions distinctly so IR attribution doesn't collapse during an investigation.
6. Update acceptable use policy and training. Explicitly cover local models, coding assistants, and agents — not just chatbots. Include the reporting channel for requesting new AI tools, with a committed response SLA so the sanctioned path is faster than the shadow path.
7. Feed DLP and CASB with AI-specific detections. Add the inference endpoint list from the KQL query to your proxy/CASB policy, alert on bulk prompt payloads containing data-classification keywords, and monitor for sudden new outbound AI endpoint relationships from sensitive departments (finance, HR, R&D, clinical systems).
The organizations that contain shadow AI successfully in 2026 won't be the ones that blocked the hardest — they'll be the ones that discovered the fastest and gave employees a governed path to the productivity they were chasing anyway.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.