Your Team Already Uses AI. Here's What It Can Leak (and How to Lock Down Copilot)

Your staff use AI tools you never approved, and some of what they paste into them is sensitive. In IBM's 2026 breach study, workers using unapproved AI tools figured in 43% of incidents, more than double the year before. The approved tools carry risk too. Microsoft 365 Copilot can surface any file a user already has access to, and on many SharePoint sites that is far more than anyone intended. Most of the fix is configuration you already pay for: tighter permissions, labels and DLP, blocks on unsanctioned tools, and written rules.

What is shadow AI, and how common is it?

Shadow AI is any AI tool your people use for work without IT knowing about it or approving it. A personal ChatGPT account used to summarize a contract counts. So does a free browser extension that rewrites emails. Nobody at your company has checked where that data goes or who can see it.

LayerX's 2025 data found that 77% of employees paste data into generative AI tools, and 82% of those pastes come from personal accounts, outside company controls. Of files uploaded to these tools, 40% contained personal or payment card data. Generative AI now accounts for 32% of all corporate-to-personal data movement in LayerX's data.

Cyberhaven's 2026 report lands in the same place. It found that 39.7% of data movements into AI tools involve sensitive data, which works out to roughly once every three days per employee. About 32.3% of ChatGPT use ran through personal accounts, and 82% of the top 100 generative AI apps were rated medium, high, or critical risk.

In a Gartner survey, 69% said they suspect or have evidence that staff use prohibited public AI tools. Gartner predicts more than 40% of organizations will have a security or compliance incident tied to unauthorized AI by 2030.

The shadow AI numbers in one place

How does an AI assistant get turned against you?

The main technique is prompt injection. An attacker hides instructions inside content the AI will read later, like an email, a web page, or a code issue. The AI can't reliably tell your instructions from the attacker's, so it follows both. OWASP ranks this as LLM01, the top risk for LLM applications, ahead of sensitive information disclosure (LLM02). Excessive agency, where an AI has more permissions than it needs, was LLM06 in the 2025 list and moved up to number three in the 2026 edition announced in September.

EchoLeak (Microsoft 365 Copilot). Tracked as CVE-2025-32711, this was an AI command injection flaw that let an unauthorized attacker disclose information over a network. It scored 9.3, rated Critical. It was zero-click, so an attacker could trigger it without the user doing anything. Microsoft fixed it on the server side, and no exploitation in the wild was reported. The user never clicked anything.

The Comet AI browser. Brave's researchers showed that hidden instructions on a web page could get Perplexity's Comet browser to pull the user's email address and a one-time password. As Brave put it, "traditional Web security assumptions don't hold for agentic AI." An AI browser acts with your logged-in sessions, so a malicious page can act with them too.

The GitHub MCP server. Invariant Labs showed that a malicious public GitHub issue could hijack an AI agent connected through the official GitHub MCP server. The agent then leaked private repository data into a public pull request. The attacker only had to open an issue.

OWASP's Top 10 for Agentic Applications, released in December 2025, uses these kinds of incidents as examples. EchoLeak illustrates ASI01, Agent Goal Hijack. The GitHub MCP case illustrates ASI04, Agentic Supply Chain. ASI03, Identity and Privilege Abuse, covers agents that hold more access than their job requires.

Why does Copilot overshare what's in SharePoint?

Microsoft says Copilot and agents respect existing permissions. The same page adds: "By default, SharePoint sets sharing settings to the most permissive option."

So if a salary spreadsheet sits in a site shared with "Everyone except external users," every employee could open it before Copilot arrived. Few ever went looking. Copilot searches for them. A question like "what did we pay the new operations manager?" can return an answer drawn from a file the person was never meant to see, with no hacking involved.

Find and close those old overshares before you turn Copilot on. Microsoft's SharePoint Advanced Management tools handle this, and they're in the checklist below.

Should AI agents be treated as identities?

Yes. Since May 2026, Copilot Studio creates an Entra Agent ID for each new agent, and you can't opt out. Each agent shows up in your directory with its own identity, so you can see it, scope it, and apply policy to it the way you would a user or service account.

You also have more identities to manage. If an agent can read every mailbox, an attacker who hijacks it through prompt injection can read them too. OWASP's ASI03 category covers this risk. Give agents the least access they need, and review them the same way you'd review a new hire's access.

What does an AI-related breach cost?

IBM's 2026 Cost of a Data Breach study, covering 602 organizations breached between March 2025 and February 2026, put the global average breach at $4.99 million, up 12%. One in four malicious breaches was AI-enabled, a 56% jump, and those averaged $6 million. More than 20% of organizations had a breach that targeted their AI models or applications. About 7 in 10 breached organizations had no AI governance in place.

IBM's 2025 study put the average U.S. breach at $10.22 million. Organizations with heavy shadow AI use paid $670,000 more per breach. Of the 13% that reported breaches of AI models or apps, 97% lacked proper AI access controls, and 63% of organizations had no AI governance policy or were still writing one.

For a fuller breakdown of where breach costs come from, see the true cost of a data breach in 2026.

What does California law require?

If you do business in California, the California Privacy Protection Agency's newer rules matter here. The CPPA finalized regulations on automated decision-making technology (ADMT), risk assessments, and cybersecurity audits, effective January 1, 2026. ADMT compliance starts January 1, 2027. Cybersecurity audits are phased in from 2028 to 2030 by revenue, and businesses under $50 million in revenue have until April 1, 2030. They apply if you meet the CCPA thresholds, so check with counsel.

On September 9, 2026, the governor signed SB 813 and AB 1405. SB 813 deals with independent AI verification organizations, and AB 1405 sets up a state registry of AI auditors. The announcement didn't give effective dates, so watch for guidance before you plan around them.

The 8-step Microsoft 365 checklist

These steps use controls in Microsoft 365 plus some policy work. Licensing varies by plan, so confirm what your tenant includes.

1. Run the SharePoint Advanced Management data access governance reports. They show which sites are shared broadly, including with "Everyone except external users." Run them at least every 30 days. Start with sites holding HR, finance, legal, and client data.

2. Lock down sensitive sites with Restricted Access Control and Restricted Content Discovery. Both are part of SharePoint Advanced Management. Restricted Access Control limits who can get into a site. Restricted Content Discovery keeps a site from showing up in Copilot results. Use them on the sites the reports flag.

3. Apply Microsoft Purview sensitivity labels. Label contracts, payroll, health records, and client files. Labels are what DLP policies read, so this step makes step 4 work. DLP can stop Copilot from processing labeled files.

4. Turn on DLP for Microsoft 365 Copilot. Purview DLP can also block sensitive information types in prompts, such as Social Security or card numbers typed into Copilot. One gap to know about: DLP doesn't scan files that users upload into prompts. Cover that with labels, training, and your acceptable-use policy.

5. Exclude external email from Copilot grounding. Anyone on the internet can send your staff an email, which makes outside mail an easy place to hide instructions. Microsoft notes that excluding external email reduces prompt-injection risk.

6. Block unsanctioned AI apps and personal-account logins. With 82% of AI pastes coming from personal accounts, blocking unapproved tools and personal logins on company devices closes the biggest leak. Give people an approved option at the same time, or they'll find a workaround. Vet AI browsers and MCP connections before anyone installs them, given the Comet and GitHub MCP cases.

7. Write an AI acceptable-use policy. Say which tools are approved, what data can never go into them, and how to request a new tool through IT. IBM found about 7 in 10 breached organizations had no AI governance. Keep it to a page or two.

8. Inventory AI agents in Entra Agent ID and apply least privilege. Every Copilot Studio agent now gets an Entra Agent ID. List them, name an owner for each, cut access to what the agent needs, and apply Conditional Access as you would for users. This addresses OWASP's ASI03, Identity and Privilege Abuse.

For a wider framework, map these controls to the OWASP lists above and to the joint CISA, NSA, and FBI guidance on AI data security. Agent least privilege also fits into a zero trust architecture. And since prompt injection often arrives by email, your phishing defenses help here too.

How AdVran helps

AdVran is an MSP and MSSP based in Anaheim. Most of the checklist above falls under our Microsoft 365 management work: SharePoint permission reviews, Purview labels, DLP for Copilot, and agent inventories. Blocking unsanctioned apps and watching identity activity sit with our cybersecurity services. For the AI acceptable-use policy and the CPPA questions, our compliance and risk management team can help you draft the policy and sort out which rules reach your business. We can work through the eight steps with your team or hand you the findings to act on yourself.

Frequently Asked Questions

Is Microsoft 365 Copilot safe for a small business to use?

It can be, once your permissions are cleaned up. Copilot respects existing permissions, so the risk comes from files that are already shared too widely. Review SharePoint sharing, label sensitive data, and turn on DLP for Copilot before a broad rollout.

What is a prompt injection attack?

It's when an attacker hides instructions in content an AI will read, such as an email or web page, so the AI follows the attacker instead of you. OWASP ranks it as the top risk for LLM applications. EchoLeak in Copilot is a real example.

Does DLP stop employees from pasting data into ChatGPT?

Purview DLP for Copilot covers Copilot prompts, not every outside tool, and it doesn't scan files uploaded into prompts. For personal ChatGPT accounts and other unapproved apps, you need to block them on company devices and back that up with a clear AI acceptable-use policy.

What should an AI acceptable-use policy include?

A list of approved tools, the data types that must never go into any AI tool, rules on personal accounts, and a simple process for requesting a new tool. Keep it short.

Do California's new AI rules apply to my business?

The CPPA's ADMT, risk assessment, and cybersecurity audit rules apply to businesses covered by the CCPA, with deadlines running from 2027 to 2030. SB 813 and AB 1405 set up AI verification and auditor frameworks, and their effective dates weren't in the signing announcement. Check with counsel on your specific obligations.

References

1. CVE-2025-32711 record. MITRE CVE. June 11, 2025. https://cveawg.mitre.org/api/cve/CVE-2025-32711
2. Zero-click AI vulnerability in Microsoft 365 Copilot (EchoLeak). The Hacker News. June 2025. https://thehackernews.com/2025/06/zero-click-ai-vulnerability-exposes.html
3. IBM Cost of a Data Breach Report 2025, press release. IBM Newsroom. July 30, 2025. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
4. IBM Cost of a Data Breach Report 2026, press release. IBM Newsroom. July 29, 2026. https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average
5. Coverage of IBM Cost of a Data Breach 2026. Help Net Security. July 30, 2026. https://www.helpnetsecurity.com/2026/07/30/ibm-cost-of-a-data-breach-2026/
6. Coverage of IBM breach costs and AI governance. Cybersecurity Dive. 2026. https://www.cybersecuritydive.com/news/data-breach-costs-ai-governance-ibm/826463/
7. Gartner shadow AI prediction. Infosecurity Magazine. November 20, 2025. https://www.infosecurity-magazine.com/news/gartner-40-firms-hit-shadow-ai/
8. AI as the top data exfiltration vector in the enterprise. LayerX. October 6, 2025. https://layerxsecurity.com/blog/ai-is-now-the-1-data-exfiltration-vector-in-the-enterprise-and-nobodys-watching/
9. Cyberhaven 2026 AI Adoption and Risk Report, press release. Cyberhaven. February 5, 2026. https://www.cyberhaven.com/press-releases/cyberhaven-2026-ai-adoption-risk-report
10. OWASP Top 10 for LLM Applications 2025. OWASP GenAI Security Project. March 12, 2025. https://genai.owasp.org/llm-top-10/
11. 2026 Top 10 for LLM Applications announcement. OWASP GenAI Security Project. September 2, 2026. https://genai.owasp.org/2026/09/01/owasp-genai-security-project-unveils-2026-top-10-for-llm-applications-new-agent-control-standard-and-sponsors-as-community-tops-30000-members/
12. OWASP Top 10 for Agentic Applications. OWASP GenAI Security Project. December 9, 2025. https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/
13. Prompt injection in the Perplexity Comet browser. Brave. August 20, 2025. https://brave.com/blog/comet-prompt-injection/
14. GitHub MCP vulnerability. Invariant Labs. May 26, 2025. https://invariantlabs.ai/blog/mcp-github-vulnerability
15. AI Data Security: Best Practices for Securing Data Used to Train and Operate AI Systems. CISA, NSA, FBI and partners. May 22, 2025. https://www.cisa.gov/news-events/alerts/2025/05/22/new-best-practices-guide-securing-ai-data-released
16. Get ready for Copilot with SharePoint Advanced Management. Microsoft Learn. Updated August 18, 2026. https://learn.microsoft.com/en-us/sharepoint/get-ready-copilot-sharepoint-advanced-management
17. Entra agent identities in Copilot Studio. Microsoft Learn. Accessed September 29, 2026. https://learn.microsoft.com/en-us/microsoft-copilot-studio/admin-use-entra-agent-identities
18. DLP for Microsoft 365 Copilot. Microsoft Learn. Updated September 17, 2026. https://learn.microsoft.com/en-us/purview/dlp-microsoft365-copilot-location-learn-about
19. CPPA announcement on ADMT, risk assessment and cybersecurity audit regulations. California Privacy Protection Agency. September 23, 2025. https://cppa.ca.gov/announcements/2025/20250923.html
20. Governor Newsom signs AI safeguards including SB 813 and AB 1405. Office of the Governor of California. September 9, 2026. https://www.gov.ca.gov/2026/09/09/governor-newsom-signs-first-in-the-nation-ai-safeguards-to-protect-californians-calls-on-the-federal-government-to-do-its-part/

Related Reading

• Zero Trust Architecture: A Practical Guide
• Building a Phishing Defense Strategy
• The True Cost of a Data Breach in 2026
• AI Is Now Hacking Servers on Its Own: What It Means for Your Patch Window
• How California Businesses Stop Deepfake Wire Fraud