# Shadow AI

> Why people paste company data into assistants, what your existing controls can and cannot see, and what actually reduces it.

- [Find the MCP servers employees have installed](https://elaichi.ai/blog/find-mcp-servers-employees-installed/) — No admin console lists the MCP servers employees have installed. The order that works: a device sweep, the vendor logs that exist, then a direct ask.
- [Stop sharing personal API keys with AI tools](https://elaichi.ai/blog/stop-sharing-personal-api-keys-with-ai-tools/) — Find where people sharing personal API keys with AI tools put them, lean on what the key issuers already catch, then remove the reason to paste one.
- [Replace personal MCP servers on employee laptops](https://elaichi.ai/blog/replace-personal-mcp-servers/) — Find the MCP servers employees run from each client's config file, then replace personal MCP servers and their tokens with one governed endpoint.
- [Engineers using ChatGPT at work: block or scope it](https://elaichi.ai/blog/shadow-ai-cto-engineers-already-have-chatgpt/) — For engineers using ChatGPT at work, scope access rather than block it. A block moves the paste to a phone; scoped access removes the reason to paste.
- [Employees pasting customer data into AI](https://elaichi.ai/blog/shadow-ai-coo-customer-emails-pasted/) — No single log records employees pasting customer data into AI. Measure it from three partial sources, report a range, and remove the reason to paste.
- [CASB and AI agents: what each layer can see](https://elaichi.ai/blog/casb-dlp-vs-governed-mcp-endpoint/) — CASB and AI agents: a CASB sees who reached which AI service and how much data moved, but not which tool an agent ran or which account it changed.
- [Proving AI actions in access review evidence](https://elaichi.ai/blog/shadow-ai-security-lead-access-review-evidence/) — To prove AI actions in access review evidence, record the person and the client behind each call as it happens. SaaS logs name the account, not the client.
- [Shadow AI browser extension log: what it proves](https://elaichi.ai/blog/shadow-ai-it-admin-browser-extension-log/) — A shadow AI browser extension log proves which AI extensions are installed, where, and which sites they asked to read. It cannot show what anyone pasted.