- Engineer — Plan: Underground AI proxy services capturing user prompts represent a shadow-IT risk if employees seek cheaper LLM access; audit API usage logs for unauthorized AI service traffic and enforce an approved-services allow-list.
- SOC/IR — Learn: Emerging TTP: threat actors operate MITM-style LLM proxy services to harvest organizational prompts at scale; no IOCs provided, but this informs future DLP and proxy-monitoring detection design for AI service abuse.
- Leader — Plan: If employees use discounted underground AI services, proprietary business data in their prompts flows directly to threat actors; review and communicate AI acceptable-use policy and evaluate DLP controls for prompt exfiltration this quarter.