'Organizations need to stop workarounds and regain control': Report finds many firms don't know what their workers are sharing with AI tools

• Despite being given approved tools, workers still prefer ChatGPT, Gemini, Claude
• One in ten firms are adding 10,000 agent or machine identities every month
• Companies need to listen to workers and treat AI like an identity going forward

Around two in three UK organizations admit they can't even track whether their employees are sharing data via approved AI platforms, creating significant visibility blind spots.

New data from Sailpoint reveals workers are increasingly using popular AI tools like ChatGPT, Gemini and Claude despite certain other tools being provided, suggesting companies aren't listening to worker needs.

Sailpoint CEO Mark McClain explained: "As use of AI systems becomes more widespread, the situation is only going to get more out of control if organisations fail to put the right guardrails in place – compounded by other tools flying under the radar."

Shadow AI is causing major visibility gaps

It seems that 82% of businesses have invested in AI and data skills and half as many (41%) have hired dedicated roles as a result, however 45% of IT leaders say they still don't have enough insight into where and how company data is being shared across AI tools.

And the worst is yet to come, because while workers are frequenting unauthorized GenAI tools, agentic AI could amplify the effects even further. Four in five say AI agents are taking unintended actions like accessing or sharing the wrong data, and this comes at a point when as many as 12% of firms are adding up to 10,000 AI agents or machine identities per month.

"Organisations need to stop workarounds and regain control," McClain added. "That takes a combination of skills and awareness, but it also fundamentally boils down to a challenge around identity."

Looking ahead, two clear routes emerge for companies to contain AI usage. Firstly, they should acknowledge the types of tools workers require and put guardrails in place for those, and secondly, with the rise of agentic AI, companies need to treat AI like an identity problem assigning data access controls to prevent unwarranted leaks.

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.