Ask a security team where AI runs in their company and you’ll usually get the approved list: the enterprise chatbot, the copilot licenses. Ask a developer and you’ll get a longer answer. If your AI inventory came from procurement records and app approvals, I’d bet it’s missing the AI most likely to leak data. Most security stacks were built around the traffic that crosses the network or the actions a person takes. Here are four incidents from 2025 that show how AI slips past both types.
1. AI on the endpoint is invisible to network-based controls
In August 2025, attackers published malicious versions of Nx, a widely used JavaScript build tool, to npm. As The Hacker News reported, the malware looked for AI command-line tools already installed on developer machines, including Claude Code, Gemini CLI, and Amazon Q CLI, and prompted them with flags like –yolo and –dangerously-skip-permissions, to search the filesystem for secrets. It leaked 2,349 distinct secrets, most of them GitHub tokens, by posting them to public repositories under the victims’ own accounts.
To the network, this looked like a laptop talking to an AI provider and to GitHub, while the reconnaissance ran on the endpoint through a tool the developer had installed on purpose.
Local models are even harder to see, since they talk over loopback and never leave the machine. Blocking public AI sites won’t help… it tends to just push people onto personal devices (47% of employees use personal AI accounts that bypass corporate controls). Coaching people toward approved tools in real time works better, but discovery has to include process lists, listening ports, and loopback traffic on managed devices, or you’re only inventorying the AI that chose to be seen.
2. Securing the chatbot doesn’t secure what sits behind it
I’d argue an AI security review that stops at the model or the API gateway is reviewing the wrong asset, and the chatbot McDonald’s used to screen job applicants shows why. On its McHire site, applicants chat with Olivia, a bot built by Paradox.ai. In June 2025, security researchers Ian Carroll and Sam Curry found a staff login page and got in with a test account, unused since 2019 (the username and password were both 123456). An insecure API behind that account let them step through applicant records, and SecurityWeek reported that the flaws exposed data tied to about 64 million applications. Paradox.ai fixed both issues quickly, said that the researchers viewed only a handful of records, and admitted that “none of our penetration tests previously identified the issue.”
The Olivia bot wasn’t shadow AI. It shipped inside a hiring platform McDonald’s had already approved, and the chatbot itself was never the weak point. Testing needs to cover the full AI pipeline, including the databases, the jobs that load them, and every account with access.
3. Agent traffic looks routine until something classifies it
The Model Context Protocol (MCP) lets AI agents call tools and data sources directly, and in September 2025 Koi Security found what it called “the first malicious MCP server seen in the wild”. The npm package (postmark-mcp) copied a legitimate library that lets agents send email through Postmark… and then version 1.0.16 added a single line of code that BCC’d every outgoing message to an address the attacker controlled. It was downloaded 1,643 times before it was pulled.
Most network controls had little reason to flag this, because it looked like an agent sending email. It’s the pattern we described in The Mythos Moment, where an authenticated agent does damage while following its authorised instructions. That agentic traffic needs the same session-level inspection and access policy you apply to the traffic that comes from your human workforce, down to a level of detail that would spot an extra recipient on every message. Classification won’t cover everything, though, because it tells you what an agent did but can’t tell you whether an action inside its authorized scope was a mistake, which still takes human judgment.
4. Bad data reaches the model before anyone classifies it
While most existing AI controls focus on prompts and responses, critical data risk begins much earlier during training. DataComp CommonPool, one of the largest open-source AI training sets, has been downloaded more than two million times and relies on an automated process to blur faces in images. However, in July 2025, researchers reported that an audit of just 0.1% of the set uncovered thousands of validated identity documents (including passports, credit cards, and birth certificates) estimating that the blurring process missed approximately 102 million faces overall.
Within organizations, similar risks arise when unvetted internal exports feed directly into downstream pipelines. In fact, the average enterprise already registers 223 AI data policy violations every month. Classifying data prior to export is essential, as removing sensitive information after model training typically requires starting the process over.
AI use is moving faster than AI policy
Netskope research found that 68% of organizations still govern AI reactively, responding only after issues surface, and each of these four examples shows what reactive governance looks like.
Notice how ordinary each starting point was. The problems start to roll when noone is keeping an eye on the effects. Could your team list, today, every AI tool running on developer laptops and every MCP server your agents call?
At Netskope, we built the our platform to extend discovery and policy across the network, the endpoint, self-hosted models, agent and MCP traffic, and the data pipelines behind them. Netskope Skylight AI Command Center, for example, discovers managed and shadow AI, identifies AI embedded in SaaS apps, detects MCP server activity, and connects that activity to DLP and guardrail signals.
Learn how Netskope Skylight AI Security approaches these four blindspots as one connected system.
Sources
· Cloud and Threat Report 2026, Netskope Threat Labs, 2026
· AI Risk and Readiness Report, Netskope, 2026
· Malicious Nx Packages in ‘s1ngularity’ Attack Leaked 2,349 GitHub, Cloud, and AI Credentials, The Hacker News, August 2025
· McDonald’s Chatbot Recruitment Platform Exposed 64 Million Job Applications, SecurityWeek, July 2025
· First Malicious MCP Server Found Stealing Emails in Rogue Postmark-MCP Package, The Hacker News, September 2025
· A major AI training data set contains millions of examples of personal data, MIT Technology Review, July 2025
