'Shadow AI' Hidden in Approved Software Emerges as New Data-Leak Risk for Enterprises

AI features quietly added to software a company has already approved are becoming the biggest risk posed by so-called "shadow AI." An article published April 9, 2026, by the cybersecurity outlet The Hacker News flags this overlooked attack surface. While debate has long centered on unsanctioned tools employees adopt on their own, the focus is shifting to AI capabilities embedded after the fact into already-approved software, which can be enabled without additional approval and reach corporate data. Security teams, the article argues, need to know where AI is running, what data it can access, and what employees are putting into it.