You paste a client email into a chatbot to tighten the wording. It takes ten seconds and the result is better. But where did that email go, who can read it, and does your employer even know you did it?
According to CXOToday.com, a Trellix audit found that 63% of CISOs (chief information security officers) lack visibility into employee AI tools, as third-party data risks soar. That's the headline, and it's the only detail from the report I'm relying on here. The rest of this post is background on why that gap exists and what you can do about it as a regular worker, freelancer, or small business owner.
What the headline tells you, and what it doesn't
A CISO is the executive responsible for protecting a company's data and systems. The headline says most of them can't see which AI tools employees are using. It also says risks tied to third parties, meaning outside vendors and services that touch company data, are growing.
It doesn't say employees are doing something malicious. In most workplaces the gap comes from ordinary behavior: someone finds a free tool, it helps, and they keep using it. Nobody told them not to, and nobody told them how to do it safely either.
It also doesn't tell you how any particular company handles your data. That's why the practical steps below focus on what you can control and check yourself.
Why "shadow AI" is hard for companies to spot
Security teams traditionally track software the company buys and installs. AI tools break that pattern in a few ways:
- They run in a browser. Nothing gets installed, so there's no purchase order or IT ticket.
- They're often free or cheap. An employee can start on a personal account with a personal email.
- They hide inside other apps. Note-taking apps, email add-ons, browser extensions, and design tools now include AI features, sometimes switched on by default.
- They run on phones. A personal phone used for work is outside most monitoring.
Add vendors who plug AI into their own products, and your data may pass through several companies you never chose. That's the "third-party" part of the headline.
Who is affected, and how
Employees at larger companies
You may be covered by a policy you've never read. Pasting customer data, financial figures, source code, or HR details into an unapproved tool could be a policy violation, and in some industries a legal one. Discipline over this is a real possibility, even when your intent was just to save time.
Employees at small businesses
Often there's no policy and no security chief at all. That sounds freeing, but it means the owner may be carrying risk without knowing it, and you're making judgment calls alone.
Freelancers and self-employed people
You are the security department. Client contracts often include confidentiality clauses, and some now mention AI specifically. Feeding a client's unpublished material into a tool could breach an agreement you signed.
Job seekers
Resume builders, interview-prep tools, and cover letter generators all collect personal details. Be picky about where your phone number, address, and work history end up.
A five-minute test before you paste anything into an AI tool
Run through these questions each time. They get fast with practice.
- Is it allowed? Check your employer's AI or acceptable-use policy. If you can't find one, ask your manager in writing.
- Whose data is it? Customer, client, patient, student, or coworker information isn't yours to share.
- Could it identify someone? Names, emails, account numbers, addresses, and health details are the high-risk category.
- Is it confidential business material? Unreleased plans, pricing, contracts, legal matters, and financials usually are.
- Which account are you on? A work-provided account with company terms is a different situation from a personal free account.
- Does the tool use your input for training or keep it? Look in the settings and privacy terms. Many tools offer a way to opt out or turn off history, but the options vary and change, so check the current version.
If any answer is "no" or "I don't know," strip out the sensitive pieces or skip the tool for that task.
A worked example with made-up details
Say you're an office coordinator at a 40-person company. Your boss asks you to summarize a 12-page vendor contract by end of day. You paste the full text into a free chatbot on your personal account.
What went wrong? The contract probably has pricing, the vendor's name, and confidentiality terms. You've shared all of it with a service your company hasn't reviewed.
A safer path looks like this:
- Ask your manager: "Are we okay using an AI tool to summarize contracts, and if so which one?"
- If the answer is yes, use the approved tool or account.
- If the answer is unclear, read the contract yourself and use AI only on non-sensitive tasks, such as turning your own bullet points into a cleaner email.
- Whatever you use, read the output against the original. Summaries can drop or distort clauses.
That's an extra two minutes of asking, against the possibility of a very uncomfortable conversation later.
What's usually safe, what's risky, and what to avoid
| Type of content | Risk level | Better approach |
|---|---|---|
| Public information, general questions | Low | Fine for brainstorming and learning |
| Your own draft with names removed | Low to medium | Replace names and numbers with placeholders |
| Internal documents, meeting notes | Medium to high | Use only an approved tool, with permission |
| Customer or client records | High | Don't paste; follow company or contract rules |
| Passwords, account numbers, Social Security numbers | Never | Don't enter these into any AI tool |
How the advice changes for your situation
If your employer has a policy
Read it once, fully. Note which tools are approved and which data types are off limits. If it's vague, ask for clarification by email so you have a record.
If your employer has no policy
Don't treat silence as permission. Raise it. Managers at small companies are often relieved when someone proposes simple rules, such as "no customer data in AI tools, and tell me what you're using."
If you freelance
Reread your client contracts for confidentiality and AI language. Keep a short note of which tools you use on which projects. If a client asks, you'll have a straight answer, and some clients appreciate you volunteering it.
If you use AI on a phone
Check app permissions. Some AI apps ask for access to contacts, microphone, or files. Grant only what the task needs.
Scams that ride the AI wave
Whenever a topic gets attention, scammers follow. A few patterns to watch for:
- Fake AI tool sites and extensions. Lookalike sites and browser add-ons can steal logins or install malware. Go to a tool's official site directly rather than clicking an ad or a link in a message.
- Fake job offers that ask for money. A real employer doesn't charge you for equipment, training, or "AI software access." Walk away.
- Task scams. Messages offering pay for liking videos, boosting products, or completing "AI training tasks," often followed by a request to deposit money to unlock earnings, are a known fraud pattern.
- Guru courses. Anyone selling a program that promises AI-powered income, especially with screenshots of earnings and a countdown timer, is selling hope. Real online work takes time and faces plenty of competition.
- Crypto schemes. Be suspicious of any "AI trading bot" that promises returns or asks you to send coins.
If you've been targeted, the Federal Trade Commission at ftc.gov accepts fraud reports.
Common mistakes to avoid
- Using a personal account for work content. It puts company data somewhere your employer can't manage or delete.
- Trusting the output without checking. AI tools can state wrong facts confidently. You're accountable for what you send under your name.
- Hiding your use. Secret use looks worse than open use if something goes wrong. Many employers are still deciding what they allow, so being upfront often goes over better than you'd expect.
- Installing every extension. Each add-on is another party with access to what's on your screen. Remove the ones you don't use.
- Reusing passwords. If an AI service you sign up for is breached, a reused password exposes your other accounts.
What to watch for next
Expect more companies to publish AI-use rules, offer approved tools, and ask employees to acknowledge policies. Expect clients and contracts to add AI clauses too. Keep an eye on your employer's announcements, and on privacy-policy updates from tools you already use, since terms can change.
Frequently asked questions
Can I get fired for using AI at work?
It depends on your employer's rules and what data you used. Using an unapproved tool with sensitive information is the situation most likely to cause trouble. Check your policy and ask before you assume.
Is it safer to use a paid version than a free one?
Not automatically. Paid and business plans sometimes offer stronger data controls, but terms vary by provider and change. Read the current privacy terms for the specific plan.
Should I tell my boss I use AI?
In most cases, yes, especially if your work involves anyone else's information. A short conversation about what you use it for and what you keep out of it builds trust.
What if I already pasted something sensitive?
Tell your manager or IT contact promptly. Check whether the tool lets you delete the conversation and turn off history. Reporting early usually matters more than the original slip.
Your next step
Today, list every AI tool and AI-enabled app you've used for work in the past month. Next to each, write what kind of data you put in. Then send your manager one short message asking which of them are approved.
This article is for general information only. Results from any side hustle or online business vary widely, and nothing here is a promise of income. Be wary of anyone who guarantees easy money.