For years, many companies viewed artificial intelligence as an emerging technology—promising but not urgent. That perception is now obsolete. A new report from LayerX, a company specializing in AI and browser security, shows that AI has become the primary channel for corporate data exfiltration, surpassing even shadow IT apps and uncontrolled file sharing.
In other words: the real risk isn’t in future leaks, but in the tools your employees are already using today, every day, without oversight.
From “Emerging” to Essential in Record Time
In just two years, generative AI tools—like ChatGPT, Claude, or Copilot—achieved adoption levels that email took decades to reach. According to LayerX, 45% of employees already use some form of AI tool, and ChatGPT alone has a 43% penetration rate.
AI now accounts for over 11% of all enterprise app activity, placing it alongside major productivity and file-sharing platforms. But this explosive growth comes with a problem: lack of control.
The report notes that 67% of AI sessions happen via personal or unmanaged accounts, leaving security leaders (CISOs) practically blind to what happens with corporate data.
% of Users Accesing Different SaaS Categories (Source: The Hacker News)
Sensitive Data Is Already Leaving Companies
Most alarming: data leakage is already occurring. According to the report:
- 40% of files uploaded to AI tools contain sensitive information—personal, financial, or client data.
- 4 in 10 of those files are uploaded from personal accounts.
And it’s not just files. The real risk, says LayerX, lies in copy-and-paste.
- 77% of employees copy and paste information into AI tools.
- 82% of that activity happens outside the corporate environment.
- On average, each employee makes 14 pastes per day, at least three of which include sensitive data.
This makes copy-paste the number one data exfiltration route, far surpassing traditional channels. Worse, current Data Loss Prevention (DLP) solutions don’t even monitor this behavior—they were built for file-based or internal systems.
Read more: HexStrike AI: New Tool Putting Enterprise Cybersecurity to the Test
The False Sense of Security of Corporate Accounts
Many security leaders assume using a corporate account equals a secure environment. LayerX’s data shows the opposite.
- 71% of CRM logins lack federated authentication.
- 83% of ERP logins lack it as well.
In practice, an unfederated corporate account is as insecure as a personal one. Logging in with a work email doesn’t guarantee visibility or control over the data the user handles.
Corporate vs. Non-Corporate Access Across Website Categories (Source: The Hacker News)
Instant Messaging: The Silent Leak
While AI is the fastest channel for data exfiltration, instant messaging has become the quietest. According to the report:
- 87% of business chat usage occurs through unmanaged accounts.
- 62% of users send personal or financial information through them.
This combination of uncontrolled AI and unsupervised chats creates a double blind spot for cybersecurity teams. Data moves constantly between personal tools, corporate platforms, and external services without tracking or timely incident detection.
Result: traditional enterprise security strategies are fighting the wrong war—still focused on servers and files, while the real battle is in the browser.
You might also be interested in: Xanthorox AI: A New Malicious AI Tool Emerges on the Darknet
The Browser: The New Security Perimeter
LayerX underscores that the corporate perimeter has radically shifted. Today, the risk isn’t in internal networks or data servers but in the browser, where employees switch between personal and professional accounts, access AI tools, and move data between platforms with a single click.
This poses a major challenge for security leaders: how to protect data in hybrid, borderless environments.
% of Users that Paste Data to Enterprise Applications (Source: The Hacker News)
How Companies Should Adapt
The study suggests several strategies for addressing this new era of invisible leaks:
- Treat AI security as a strategic priority.
Apply the same levels of control and monitoring as email or storage systems.
- Shift from file protection to action protection.
Data is lost not just through uploads or downloads but through non-file actions: copy, paste, chat, or prompt generation.
- Restrict personal account usage and require federated authentication.
Unmanaged accounts are invisible to security teams. Policies blocking or limiting them are key.
- Prioritize the highest-risk categories.
AI, messaging, and cloud storage combine high usage with high data sensitivity.
- Monitor the browser as the new perimeter.
Implement tools that provide real-time visibility into user activity and detect suspicious behavior tied to AI or chat.
What This Means for Security Leaders
The message of the report is clear: AI is not just transforming productivity—it’s challenging corporate governance.
The tools driving innovation are also the least controlled, and the gap between use and oversight grows daily. For CISOs, this means it’s no longer enough to wait for AI to “mature.” The shift is already happening, and risks multiply while organizations play catch-up.
As LayerX puts it:
“AI isn’t just shaping the future of work. It’s defining the future of data leaks.”
Conclusion: Act Now
Artificial intelligence is no longer an emerging risk; it’s an active, everyday threat to corporate security. Thousands of employees use ChatGPT, Copilot, or other AI platforms with good intentions but without proper safeguards.
At TecnetOne, we recommend organizations:
- Implement access controls and monitoring at the browser level.
- Establish clear policies on AI and personal account usage.
- Invest in cybersecurity technologies tailored to the AI context.
- Promote digital education and risk awareness among employees.
The corporate perimeter is no longer within server walls—it’s in each user’s hands. In the age of AI, security must be as smart as the tools challenging it.