A personal AI account inherits consumer terms and everything its user can reach

Step one of the shadow AI chain, in the taxonomy published as "AI Threat Awareness Program" on dev.to ^[18], is an employee using a personal AI account for a work task ^[5]. Step two is not an event: the vendor's consumer terms of service apply, not a corporate agreement, and they applied before anyone typed anything ^[5]. Step three happens on someone else's disk, where prompts and data are logged or used for training outside company control ^[5]. Step four is the exposure, through a vendor breach or reproduction in model output ^[5]. Three of the four steps sit outside the company's control boundary ^[16].

That leaves detection to the traffic. The post lists three indicators: outbound traffic to AI service domains from non-corporate accounts, DLP alerts flagging AI-related data egress, and unapproved browser extensions or local model runners on endpoints ^[6]. Two of the three can be seen from the network, and the third can only be seen on the endpoint ^[13]. Local inference is the case the network controls miss, because a model running on the laptop sends no request to an AI service domain for the proxy to match ^[20].

The remediation list is four items: a formal AI intake and sanctioning process, blocking or allowlisting AI domains at the proxy, a sanctioned enterprise alternative, and DLP monitoring ^[7]. The last is written as "Apply DLP monitoring with no exemptions, sanctioned tools included" ^[12]. In my view that is the item to argue about, because it puts the approved tool under the same inspection as the unapproved ones. An exemption for the sanctioned path moves the egress and leaves it uninspected.

Where a threat sits in this taxonomy decides where its control goes. Six threats are listed, four of them vectors that create exposure and two of them impacts that describe the cost when a vector succeeds ^[1]. Sensitive data exposure is filed as an impact, and the post calls it a common outcome of Shadow AI, Prompt Injection, and Rogue Agent behavior ^[8]. That names three of the four vectors ^[14]. Its own chain puts the missing control at step two: sensitive data enters a prompt or an agent's working context, and no content-level DLP inspects it before it leaves ^[9].

Three of the four shadow AI remediations are configuration or tooling, and the fourth is an intake process ^[15]. A written policy statement is not among them. The post does not include incident counts or any measure of how far these controls cut egress ^[19].