Shadow AI Is Now Hiding Inside Sanctioned AI Tools

Ankita Gupta — Co-Founder and CEO at Akto

Aug 31, 2026

AI coding agents are already inside engineering organizations.

The problem security teams need to solve is not only that AI-generated code might be vulnerable. You already have ways to catch that: code review, CI, SAST, dependency scanning, and production monitoring.

The real problem is that tools such as Claude Code, OpenAI Codex, Claude Cowork, and GitHub Copilot are becoming extensible agent runtimes. Skills, plugins, hooks, repository instructions, and MCP servers can influence what the agent reads, which tools it selects, what commands it runs, and where enterprise data is sent.