Shadow AI Audit: Find the Hidden AI Tools in Your Company

Last updated: October 18, 2026

On 14 October 2026, a startup called Pluto Security stepped out of stealth with $42 million to do one job: police the AI agents and apps employees are building inside their companies. Its CEO’s pitch was deliberately unsettling — in every proof-of-concept so far, Pluto says it found “malicious stuff”, including active live attacks. Whether or not you ever buy Pluto’s product, the problem it names is real: AI tools are entering company networks faster than IT can approve them, often within hours of release. This guide is a practical shadow AI audit — five checks any team can run this week — plus a simple framework for what to do with what you find.

Quick answer: Shadow AI audit in 5 checks: inventory AI tools, scan skills and connectors with Pluto's free Plutonium scanner, then allow, sandbox or ban each finding.

What is shadow AI, really?

Shadow AI is any AI tool, agent, skill, connector or add-on that touches company data without IT or security’s approval.

It’s shadow IT’s faster cousin. In the 2010s, employees bought SaaS apps on credit cards; in 2026, they connect AI agents to the CRM, share company documents with chatbots, and install browser skills that can read email — all in an afternoon. Pluto Security’s CEO Shahar Bahat told TechCrunch that “a newly announced AI tool can show up inside companies’ environment within a mere two hours of its release” (company statement, reported by SC Media on 14 October 2026 — no independent verification yet, but consistent with decades of shadow-IT history).

The shape of the problem is also different from classic IT security. Pluto reports that 60% of the AI risks it detects originate from tools built by non-developers — finance departments first, then marketing and legal. This isn’t engineers misconfiguring servers; it’s the finance team wiring an AI agent into the ledger spreadsheet.

What does a shadow AI audit actually find?

A real audit almost always finds more than people expect — hidden agents with live permissions, unverified skills, and tools nobody remembers approving.

To be clear about the evidence here: Pluto’s headline figures — 30+ enterprise customers, $2 million-plus in annual recurring revenue since it began selling in April 2026, and the claim that every single POC turned up “malicious stuff” — are company-reported and single-source (TechCrunch’s reporting, via SC Media and other outlets on 14 October 2026). Trade press covering the announcement has noted neither figure has independent verification yet. Treat them as directional, not gospel.

Still, the categories of findings Pluto describes line up with what security researchers have been warning about for a year: agents with broader permissions than their stated task, AI skills and connectors from unverified publishers, and tools that arrived inside the network before anyone assessed them. Our own AI agent safety guide covers the mechanics of how agents go rogue — this audit is how you find out whether any are already inside.

“There was not one POC in which we entered and didn’t find malicious stuff,” Pluto CEO Shahar Bahat told TechCrunch — including, he said, active live attacks. (Company claim, reported via SC Media, 14 October 2026; no independent verification.)

The 5-check shadow AI audit

Run these five checks in order — they go from a 30-minute scan to the ongoing discipline that actually keeps you clean.

Check 1: Inventory what’s already installed (30 minutes)

Start with the devices your team actually uses. On company machines and managed phones, list AI chat apps, browser extensions, and desktop agents — ChatGPT, Claude, Gemini, Meta’s Muse, Manus, Copilot, and every AI browser extension in Chrome/Firefox’s extension manager. Ask every team lead a direct question: “Which AI tools is your team using for work?” You will hear names you have never heard before. Write every one down; the list is the audit’s foundation.

Check 2: Map the connectors (1 hour)

Installed apps are only half the story. The riskier half is connections: OAuth grants that let an AI tool read your Gmail or Drive, connected apps in Google Workspace or Microsoft 365, Slack integrations, and AI agent skills and MCP servers wired into company systems. Pluto’s platform monitors exactly this layer — skills, extensions, and MCP servers — because a skill with broad read access is where company data quietly leaves the building. In your admin consoles, revoke anything nobody can explain. (If you’re experimenting with AI skills yourself, our Muse skills guide covers how the format works.)

Check 3: Scan the riskiest components for free (15 minutes)

Pluto launched a free scanner called Plutonium back in April 2026 — an AI supply-chain security hub with an MCP scanner and a component catalogue that checks publicly available AI skills, connectors and add-ons for risks. You don’t need to buy anything to use it: take the AI skills and connectors from Checks 1 and 2 and run them through it. Think of it as a first-pass triage, not a verdict — a flagged component goes into the sandbox pile in Check 5’s framework below. Honest caveat: we haven’t hands-on tested Plutonium ourselves; it’s worth trying, not blindly trusting.

Check 4: Trace what company data each tool touches (1 hour)

For every tool on your list, answer three questions: Who is the agent? What company data can it read? Can it prove what it did with that data? This is the same trust test we built for the AI agent identity debate — an agent that can’t identify itself or show an audit trail is a black box with your data inside it. Any tool that can read customer lists, financial records, or legal documents — and came in through Check 1 or 2 rather than a formal review — is your highest-priority item.

Check 5: Make it a monthly ritual

A one-time audit decays fast. Bahat’s two-hour claim is the operating principle here: treat every new AI tool launch as already inside your network within two hours. Put the inventory review on a monthly cadence — same five checks, smaller each time — and fold AI tool approval into onboarding so new joiners never need the unofficial route.

What to do with what you find: allow, sandbox or ban

Every finding gets one of three verdicts. The table below is the whole policy.

Verdict When What it means in practice
ALLOW Approved vendor, business need confirmed, data classification fits, audit trail exists Document it in the approved-tools register with owner, data access, and review date
SANDBOX Useful but unverified, or permissions wider than the task needs Restrict data access, time-box the pilot, re-scan components; graduate to allow or ban after review
BAN No business need, unverifiable publisher, flags on a security scan, or reads sensitive data without justification Revoke access, uninstall, document why — and tell the team what approved alternative to use

The point is not to ban AI — it’s to stop unseen AI. Most of your findings will land in the sandbox column. That’s fine. A sandbox pile with a review date is a policy; an unknown pile is an incident waiting for a name.

Why finance, marketing and legal are the blind spot

Shadow AI doesn’t start in the IT department — it starts in the teams that would never think to ask IT first.

Pluto’s 60% figure deserves one caveat: it’s a vendor’s marketing-adjacent statistic from its own customer sample, not a controlled study. But it points at something genuinely true about how AI adoption works in 2026: the people connecting agents to live business systems are the people who own those systems. A finance manager can connect an AI agent to the ledger without writing a line of code. A marketer can plug an AI skill into the CRM’s contact list. None of them will file a ticket about it, because from their perspective nothing “technical” happened.

This is also why the traditional IT inventory misses it. Software-asset-management tools were built to catch applications — licences, installs, executables. Shadow AI often isn’t an install at all: it’s a browser skill, a connector authorised through OAuth, an MCP server someone added to their AI agent’s config. Your audit has to look at permissions, not just programs.

How shadow AI differs from shadow IT

Shadow AI moves faster, touches more data, and can act on its own — which is why the old shadow-IT playbook underestimates it.

Shadow IT (2010s) Shadow AI (2026)
An employee buys a SaaS app on a credit card An employee connects an AI agent to the CRM — no purchase needed
Data exposure is bounded by the app’s features An agent with broad read access can see everything it can query
Humans act; software just stores Agents can act autonomously — send, share, execute
Shows up in procurement or licence audits Shows up nowhere until someone maps the connectors

None of this means banning AI tools company-wide. It means the approval question changed from “which apps are installed?” to “which agents can read what?” — and most companies haven’t updated the question yet.

Our take: audit before you buy

Don’t buy a shadow-AI platform before running this audit once by hand.

The honest version of our position: the five checks above will surface most of what a paid platform finds in its first POC, because the problem is visibility, not detection sophistication. Pluto’s $42 million pitch is that the findings are scary enough to justify continuous monitoring — and for regulated industries or large agent fleets, continuous monitoring is the right call. But for a team of 20 or 200, the manual audit plus a monthly ritual closes most of the gap for free, and you’ll know exactly which tools deserve the sandbox before any vendor quote lands on your desk.

The genuinely new idea in Pluto’s launch isn’t the scanner — it’s the framing. “Shadow AI” gives a name to something teams have been sensing for a year: the tools moved into the network before the policy did. Running the audit once, by hand, is how you catch the policy up.

Frequently Asked Questions

What is a shadow AI audit?

A shadow AI audit is a systematic inventory of every AI tool, agent, skill, connector and add-on touching company data without formal IT or security approval. The five checks above — inventory installed tools, map connectors, scan risky components with a free scanner, trace data access, and make it monthly — cover the full sweep.

Is Pluto Security’s Plutonium scanner really free?

Plutonium, launched by Pluto Security in April 2026, is positioned as a free AI supply-chain security hub with an MCP scanner and component catalogue, according to the company’s launch announcements. We haven’t hands-on tested it ourselves — treat it as useful first-pass triage, not a verified guarantee, and always re-check the current terms before uploading anything sensitive.

How often should we audit for shadow AI?

Run the full audit once, then repeat it monthly. Pluto Security’s CEO claims a newly announced AI tool can appear inside company environments within two hours of release — unverified, but the underlying point is solid: AI tooling moves too fast for annual reviews.

What’s the difference between shadow AI and shadow IT?

Shadow IT was unauthorised software; shadow AI is unauthorised AI agents, skills and connectors. AI moves faster, touches more data through broad permissions, and can act autonomously — so it needs a permissions-based audit, not just a software inventory.

Should small companies run a shadow AI audit?

Yes — the five checks scale down to a half-day exercise for a small team. Smaller companies are arguably more exposed: they rarely have a security function, and AI adoption there is often fastest.

Sources and methodology

This guide’s framework is built from Pluto Security’s launch coverage: TechCrunch’s reporting on the company’s $42 million stealth exit and proof-of-concept findings (14 October 2026), SC Media’s coverage of CEO Shahar Bahat’s claims including the two-hour adoption figure and the 60% non-developer statistic (14 October 2026). Company-reported figures are flagged as single-source and unverified throughout. Claims were assembled from published reporting and cross-checked across outlets; the five-check framework itself is original synthesis for this guide. Verified 17 October 2026.

Have a burning question about this topic?
Feel free to email us at contact@openaimaster.ai — we are happy to help!