Staff using AI tools nobody approved, usually because the approved options are slow or non-existent. Confidential documents pasted into consumer chatbots, code sent to whichever assistant is installed, customer data used to draft replies. For most organisations this is a larger real exposure than any sophisticated attack, and banning it outright tends to drive it underground rather than stop it.
Technical view
Detection uses network and endpoint monitoring, cloud access security brokers and browser controls, though personal devices and accounts remain a gap. The productive response combines a sanctioned alternative that is genuinely good enough, clear guidance on what may and may not be shared, and data loss prevention on the routes that remain. Enterprise agreements that exclude prompts from training, together with retention controls, address much of the underlying risk; policy without a usable alternative does not.
Related
Part of AI Terminology Index, section: Security and Privacy.