<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Shadow-Ai on CuraSec</title><link>https://curasec.metacog.co.kr/tags/shadow-ai/</link><description>Recent content in Shadow-Ai on CuraSec</description><generator>Hugo</generator><language>en-us</language><lastBuildDate>Tue, 25 Aug 2026 11:39:54 +0000</lastBuildDate><atom:link href="https://curasec.metacog.co.kr/tags/shadow-ai/index.xml" rel="self" type="application/rss+xml"/><item><title>Akamai Research: Top 5% of AI Super-Adopters Drive Outsized Enterprise Risk</title><link>https://curasec.metacog.co.kr/insights/2026-08-25-the-outsized-shadow-why-5-of-ai-users-are-your-biggest-secur/</link><pubDate>Tue, 25 Aug 2026 11:39:54 +0000</pubDate><guid>https://curasec.metacog.co.kr/insights/2026-08-25-the-outsized-shadow-why-5-of-ai-users-are-your-biggest-secur/</guid><description>&lt;ul>
&lt;li>&lt;strong>Engineer — Skip&lt;/strong>&lt;/li>
&lt;li>&lt;strong>SOC/IR — Skip&lt;/strong>&lt;/li>
&lt;li>&lt;strong>Leader — Learn:&lt;/strong> Vendor-sourced (Akamai) but the framing that a small cohort of AI power users embedding unvetted tools into critical workflows creates concentrated risk is worth noting when building AI acceptable-use policy — size this against your own AI usage data before citing it to the board, given the single-source provenance.&lt;/li>
&lt;/ul></description></item><item><title>Shadow AI Agents Proliferate Without Enterprise Security Visibility</title><link>https://curasec.metacog.co.kr/insights/2026-07-28-shadow-ai-agents-are-multiplying-here-s-how-to-find-and-secu/</link><pubDate>Tue, 28 Jul 2026 13:01:43 +0000</pubDate><guid>https://curasec.metacog.co.kr/insights/2026-07-28-shadow-ai-agents-are-multiplying-here-s-how-to-find-and-secu/</guid><description>&lt;ul>
&lt;li>&lt;strong>Engineer — Learn:&lt;/strong> No active exploitation or specific CVE, but the piece highlights how AI agents can silently accumulate OAuth scopes and API access across SaaS platforms — worth factoring into how teams audit third-party integrations and CI/CD automation going forward.&lt;/li>
&lt;li>&lt;strong>SOC/IR — Learn:&lt;/strong> No IOCs, TTPs, or detection content — this is a governance awareness article. Useful background for understanding a new blind-spot category, but yields no immediate hunt or detection action.&lt;/li>
&lt;li>&lt;strong>Leader — Plan:&lt;/strong> Shadow AI agents acquiring autonomous permissions across SaaS estates without IT visibility is a real and growing governance gap; add an AI agent discovery and authorization policy to the Q3/Q4 roadmap before ungoverned agents create unaccountable data access or trigger compliance findings.&lt;/li>
&lt;/ul></description></item></channel></rss>