It typically means using a personal ChatGPT, Claude, Gemini, or similar account to process work tasks, often pasting customer data, financial figures, or proprietary source code into a tool the employer has no visibility into or contractual protection from. Workforce research puts employee AI usage at roughly two in three workers while fewer than one in five organizations have a formal AI usage policy, and industry breach research links shadow-AI-involved incidents to meaningfully higher breach costs. Outright bans tend to push the behavior further into the shadows rather than eliminating it.