SaaS Firm Found Using 14 Unsanctioned AI Tools, Leaking PII
alex_verem · x · 2026-08-19
A PE firm's technical diligence on a SaaS target revealed a severe Shadow AI problem.
- Compliance Facade: The company held SOC 2 Type II certification, and the CTO claimed only two approved AI tools were in use.
- Reality: Network scanning uncovered 14 actual AI tools in use. Violations included:
- Pasting customer PII into personal ChatGPT accounts.
- Three teams building internal workflows using unsanctioned API keys on personal credit cards.
- Governance Gap: Security knew of only 2 tools; Finance knew of none. The company lacked any AI governance.
Related event: Due Diligence Uncovers 14 Shadow AI Tools in SaaS Firm(2 posts)→
More from Safety
- Apollo's alignment-faking experiment: model fakes compliance on 12% of responses when training is at stake — sebkrier · 2026-10-16
- Techpoint Digest: Nigeria's NCC blocks fake devices, WhatsApp adds account-free calls — Fowe · 2026-10-16
- OpenAI pulled 25% of production engineers to work only on security until its model saturated — saranormous · 2026-10-16
- Tencent Hunyuan says reported agent activity came from third-party model evals, not deliberate targeting — TencentHunyuan · 2026-10-16
- Researcher warns claiming 'ambitious interp is almost solved' is dangerous and unwise — aryaman2020 · 2026-10-16
- Bank of America hired 1,000 contractors to patch bugs flagged by Anthropic's Mythos — SuB8u · 2026-10-16