CSA-Shadow-AI-Asset-Blindness-2026.md

This CSA whitepaper describes the widespread phenomenon of 'Shadow AI'—unguarded AI tools, models, agents, and integrations operating outside organizational governance—and documents the security, supply-chain, and regulatory risks they create, including data exfiltration to third-party AI, malicious models in public repositories, documented vulnerabilities in AI integrations, and actor campaigns that delivered malware and ransomware; it concludes with practical recommendations for discovery, inventory, risk scoring (CBRA), Zero Trust controls, AI-aware DLP, supply-chain verification, and EU AI Act compliance.