‍

Shadow AI is the undeclared or unknown usage of AI within a business or organization.  It is considered a much greater security risk than Shadow IT, since even well-meaning employees can quickly compromise company data and security policies.

Many software applications used in business environments are now web based, such as Microsoft Office, Google Drive, Salesforce and others.  This shift has made web browsers part of the workspace for employees.

Browser extensions are available for every major browser, on every device. The number of employees that use extensions at work is almost identical across different sized organizations: 99.66 % of enterprise users and 99% of users in small-to-medium businesses have extensions installed on work devices.

These powerful min-programs now integrate with various AI platforms. Gen AI extensions have quickly emerged as the primary way end users interact with AI tools. No approved software or permission needed - interactions with AI can be enabled for free via a browser tab.  


THE RISKS OF GEN AI AND OTHER BROWSER EXTENSIONS

While most end users view GenAI and other browser extensions as harmless, they are not without risk:

  • No browser extension is 100% safe from attacks such as code or script injection.
    ‍
  •  Many antivirus and security applications are unable to view or control browser-based actions, such as copy/paste, form fills and file uploads - the convenience provided by a browser extension could come at the cost of your company data being used or shared in a browser extension without your knowledge.
    ‍
  • There is no formal vetting process - Major browsers review extensions for malicious content, but unfortunately, there is no formal vetting process for publishing extensions.  Trustworthiness is typically gauged by the age of the extension and number of installations.  
    ‍
  • Extensions are often granted permissions to user data or require access to data in order to function.  This access can include browser activity, network access, connections to business applications and authenticated user sessions. Permissions can also be exploited, granting threat actors the ability to inject code into webpages, access sensitive and confidential information such as saved credentials, clipboard data, session cookies and more.
    ‍
  • Even trusted extensions can become malicious. In addition to compromised developer accounts, attackers are known to target independent extension developers, offering lucrative deals to purchase popular,free extensions.  Since major browsers are designed to update extensions automatically in the background, the new owner can push a malicious update to every user of the extension, leaving end users unaware that the extension is now malicious.

‍

DEFENDING AGAINST SHADOW AI

It is very easy for a well-meaning employee hoping to streamline processes or boost efficiency to grant permission for an AI assistant to connect to your network and business applications or cut and paste proprietary information into a GenAI browser extension.

Below are some things you can do to minimize your risk:

  • Explain to employees how unapproved tools can cause data loss, compliance issues and risks to intellectual property
    ‍
  • Train your employees in the safe use of AI in the workplace
    ‍
  • Update your company’s Acceptable Use Policy to clearly explain which Gen AI tools and browser extensions are approved, restricted or prohibited and specify what data types are strictly forbidden for use in Gen AI tools and extensions (such as PII, financial and source code)
    ‍
  • Ensure end users keep personal and business accounts for web browsers and AI platforms separate, secured with strong unique passwords and MFA
    ‍
  • Download Gen AI tools and browser extensions from trusted sources
    ‍
  • Review the permissions granted to any browser extension and uninstall any extensions with unnecessary or invasive permissions
    ‍
  • Ensure web browsers are set to update automatically

‍

‍

‍