Shadow AI, Rogue Agents, and Data Leaks: A Special Report on Navigating AI Risk
Akamai's special SOTI report highlights how rapid enterprise AI adoption is expanding the threat surface through shadow AI usage, unmanaged browser/IDE extensions, and autonomous AI agents. Key findings include that 47% of enterprise AI conversations use personal accounts, 75% of AI browser extensions request high/critical permissions, and novel techniques like CometJacking and CursorJacking demonstrate how prompt injection and rogue extensions can compromise AI-driven workflows. Legacy security tools including DLP solutions are not designed to detect data exposure through AI prompts and unstructured interactions.
Detection / Hunteropenrouter
What Happened
A new report from Akamai warns that as companies rapidly adopt AI tools, they are creating new security blind spots that traditional protection tools cannot cover. The report finds that nearly half of employees use personal AI accounts for work conversations, which means sensitive company data may be exposed to public AI model training. Additionally, most AI browser extensions request broad permissions, making them attractive targets for attackers who can steal credentials or manipulate AI agents. Two specific attack techniques are highlighted: CometJacking, which tricks an AI browser into performing unauthorized actions via malicious web pages, and CursorJacking, which steals developer API keys through rogue browser extensions. Organizations should implement governance policies covering AI identities, extensions, and data flows, and evaluate whether their current data loss prevention tools can handle the new ways information is shared through AI prompts and conversations.
Key Takeaways
- Nearly half (47.11%) of enterprise AI conversations occur through personal accounts, creating governance blind spots and exposing business data to public model training.
- Approximately 75% of AI browser extensions request high or critical permissions, making them a significant attack surface for credential theft and unmanaged data access.
- A technique called CometJacking demonstrates indirect prompt injection against Perplexity's Comet AI browser, allowing attackers to manipulate autonomous AI agents via malicious web page content.
- CursorJacking illustrates how a rogue browser extension can steal Cursor AI API keys, enabling attacker impersonation of developers and compromise of AI-driven development environments.
- Legacy DLP tools are insufficient for AI-era data exposure because sensitive information is now shared through unstructured prompts, code snippets, and conversations rather than traditional file transfer channels.
Affected Systems
- Enterprise AI platforms (ChatGPT, Microsoft Copilot, Google Gemini)
- AI browser extensions and IDE extensions
- Perplexity Comet AI browser
- Cursor AI coding assistant
- Enterprise DLP and security monitoring tools
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Attacker embeds malicious instructions in a web page or deploys a rogue browser extension targeting AI-powered tools
- Execution: Indirect prompt injection (CometJacking) or extension exploit (CursorJacking) manipulates the AI agent or steals API credentials
- Credential Access: Attacker obtains API keys or session tokens from AI browser extensions or coding assistants
- Discovery and Collection: Compromised AI agent accesses sensitive enterprise data, conversations, and workflows outside of traditional security guardrails
- Exfiltration: Sensitive business data is exposed through AI prompts, personal account conversations, or public model training pipelines
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article references a downloadable SOTI report that includes a mitigation framework and checklist, but no detection rules or queries are provided in the blog post itself.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | AI prompt injection and data exposure through AI conversations occur at the application layer within browser-based or cloud-based AI platforms, which traditional EDR solutions are not designed to monitor. Rogue browser extension activity may be partially visible but the AI-specific context would be lost. |
| Network Visibility | Medium | Network-based monitoring can detect traffic to unapproved AI platforms and personal AI services, but cannot inspect the content of encrypted API calls to determine whether sensitive data is being exposed through prompts. |
| Detection Difficulty | Hard | Detecting AI-specific threats requires visibility into AI prompt content, browser extension behavior, and autonomous agent actions — telemetry that most organizations do not currently collect. Distinguishing legitimate AI usage from data exfiltration via prompts is inherently difficult without content-level inspection. |
Required Log Sources
- Browser extension inventory and permission audit logs
- CASB/SSE logs for AI platform usage and data flow visibility
- DLP logs with AI prompt and conversation content inspection
- API access logs for AI coding assistants (e.g., Cursor)
- Web proxy logs for traffic to unapproved AI services
- Identity and access management logs for personal vs. corporate account usage
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for browser extensions installed in enterprise environments that request high or critical permissions, particularly those interacting with AI platforms or coding assistants. | Browser extension inventory logs, endpoint management platform extension reports | Persistence and Access | Medium — many legitimate AI extensions request broad permissions for functionality |
| If you have CASB or web proxy visibility, consider hunting for AI platform traffic originating from personal accounts rather than corporate-managed identities, which may indicate shadow AI usage. | CASB logs, web proxy logs, identity provider logs | Initial Access and Data Exposure | Low to Medium — personal account usage on corporate networks is a strong indicator of policy violation |
| Consider hunting for anomalous API key usage patterns from AI coding assistants, which could indicate credential theft via techniques like CursorJacking. | API gateway logs, AI platform access logs, authentication logs | Credential Access and Impersonation | Medium — legitimate developers may show varied usage patterns |
| If you have browser security tooling, consider hunting for indirect prompt injection indicators in web page content that interacts with AI browsers or autonomous agents. | Browser security extension logs, web content analysis, AI agent activity logs | Execution | High — distinguishing malicious prompt injection from benign AI instructions is challenging without content analysis |
Control Gaps
- Traditional DLP solutions cannot detect sensitive data shared through AI prompts, code snippets, or unstructured conversations
- Browser extension management programs typically lack AI-specific permission auditing
- Identity governance tools may not distinguish between personal and corporate AI account usage
- Network security tools cannot inspect encrypted AI API calls for data exposure content
- Autonomous AI agent actions may operate outside of existing IAM and workflow guardrails
Key Behavioral Indicators
- Browser extensions requesting permissions beyond their functional scope, especially access to credentials or enterprise application data
- AI platform traffic from non-corporate identities or personal email accounts
- Unusual API key usage from AI coding assistants outside of normal developer working hours or from unexpected locations
- Large volumes of data being submitted to AI platforms through prompts or file uploads
- AI agent autonomous actions performed without corresponding human-initiated workflow events
False Positive Assessment
Medium — Legitimate AI usage patterns can closely resemble malicious activity, particularly when power users share business information through prompts or use personal accounts for productivity. Distinguishing between approved and unapproved AI usage requires context that many organizations do not currently capture.
Recommendations
Immediate Mitigation
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider auditing all browser extensions in your environment, focusing on those with high or critical permissions that interact with AI platforms or coding assistants.
- Consider reviewing AI platform usage logs to identify personal account usage and evaluate whether current policies address shadow AI risk.
- If your organization uses AI coding assistants, consider rotating API keys and reviewing access logs for anomalous usage patterns that may indicate credential theft.
Infrastructure Hardening
- Evaluate whether your CASB or SSE solution can provide visibility into AI platform usage and enforce policies on personal vs. corporate account access.
- Consider implementing browser security controls that can audit and restrict extension permissions, particularly for AI-related extensions.
- If applicable, evaluate AI governance platforms that can inspect prompt content and enforce DLP policies on AI conversations.
- Consider implementing network policies that restrict access to unapproved AI services while allowing sanctioned platforms.
User Protection
- Consider providing sanctioned enterprise AI accounts to reduce the incentive for employees to use personal AI subscriptions for work tasks.
- Evaluate whether your endpoint protection can detect rogue browser extensions that attempt to access credentials or sensitive application data.
- Consider deploying browser security extensions that can alert users when they are about to share sensitive information through AI prompts.
Security Awareness
- Consider incorporating AI-specific data handling guidance into existing security awareness programs, emphasizing the risks of sharing sensitive information through AI prompts.
- If applicable, consider training developers on the risks of AI coding assistant credential theft and the importance of securing API keys.
- Consider establishing an AI usage policy that defines approved platforms, account types, and data classification rules for AI interactions.
- Consider educating power users — the top 5% who generate the most AI conversations — on elevated data exposure risks and targeted governance expectations.
