Michael Morgenstern argues that shadow AI (shadow artificial intelligence) has become the default in organizations, and that it is fundamentally an identity problem rather than a tool problem. Drawing on incidents such as a calendar-invite prompt injection against an AI browser, the ClawHavoc malicious-skills campaign and stolen OAuth tokens in the Salesloft Drift breach, he shows how agents now act, not just answer, under borrowed identities. He closes with three questions and four moves for defenders: build a live inventory, enable rather than ban, give every agent its own identity, and rehearse a kill switch.

Video chapters

• 0:00 Introduction and welcome
• 1:57 Calendar-invite prompt injection and adoption
• 5:09 Data egress and borrowed agent identities
• 11:53 OpenClaw, ClawHavoc and exposed AI servers
• 15:53 Identity as the new perimeter
• 19:29 Enabling AI and three key questions
• 22:28 Four moves that change the odds
• 24:27 Hardening accounts and closing remarks
• 26:46 Questions and answers

Key facts

• According to the speaker, Censys counted around 63,000 exposed OpenClaw instances in March, and one malicious skill in the ClawHavoc campaign passed 340,000 installs before it was caught.
• In a sample of 52,000 Ollama servers, 31% answered prompts without authentication, and GreyNoise logged over 91,000 attack sessions against AI infrastructure over four months.
• Netskope found that personal AI use fell from 78% to 47% in one year, which it attributed to organizations offering approved tools.
• The speaker cited figures that only 30% of organizations have a policy to manage or detect shadow AI, and that 63% of breached organizations had no AI governance.
• Non-human identities outnumber human identities by at least 82 to 1, according to the most recent study the speaker cited.

Ideas

• Every prompt is a potential data egress event, and agents add a further risk: they take actions, often under the user's own session and tokens, so attackers and agents can look identical in the logs.
• Security awareness built over decades collapses when users follow, or fully delegate to, instructions from their AI assistant, as shown by malicious marketplace skills that told users to paste terminal commands.
• Banning AI tools pushes employees toward personal accounts and devices
• Security must shift from the 'department of no' to the 'department of how'.
• Agents may soon hold multiple identities, both by design and because they actively seek ways round guardrails to reach their objective, behavior that would be called malicious in a human.
• Sandboxes such as NVIDIA's NemoClaw contain damage but do not judge intent, leaving prompt injection detection to defenders.

Keywords

• shadow IT
• shadow AI
• agentic AI security
• non-human identities
• prompt injection
• AI governance

Quotes

• “Nothing was broken. The AI did exactly what it was told. It just wasn't told by you.”
• “Shadow AI isn't the exception anymore. It's the default.”
• “Every time you ban, you're pushing people to shadow AI.”
• “Shadow AI isn't a tool problem. It's an identity problem.”

Recommendations

• Ask three questions: do you know every tool, extension and agent in use; does every agent have its own identity rather than acting as the employee; and how quickly can you revoke it?
• Offer a broad set of approved AI tools with a secure process for requesting new ones, together with education on why sanctioned options are comparable, instead of banning AI outright.
• Harden accounts now: disable model training on your data, use phishing-resistant multi-factor authentication (MFA), review active sessions, prune permissions, disallow uncontrolled VPN extensions, and verify extensions and applications before installation.

Resources

• IBM Cost of a Data Breach Report — Report — Provides breach data linking missing AI governance to security incidents, useful for making the case to senior leadership.
• Cloud Security Alliance research on NemoClaw — Report — Clarifies the limits of agent sandboxing so defenders do not mistake containment for protection against malicious instructions.