47% of Businesses Report Sensitive Data Exposure Through AI Tools, New Research Finds

Artificial intelligence is helping businesses improve productivity, automate tasks, and make faster decisions. However, the rapid adoption of AI is also creating serious cybersecurity and data privacy challenges.

New research commissioned by BlackFog, a provider of anti-data-exfiltration solutions, reveals that 47% of security decision-makers have acknowledged an incident in which sensitive company information was exposed through an AI tool.

The findings raise concerns for retailers, brands, and sourcing and supply chain companies that are increasing their investments in artificial intelligence without necessarily having sufficient security controls in place.

According to BlackFog, businesses are adopting AI faster than they can establish effective governance, leaving confidential information vulnerable to accidental exposure and unauthorized sharing.

47% of Security Leaders Report AI-Related Data Exposure

One of the most concerning findings is that nearly half of the surveyed security decision-makers reported an incident involving sensitive information being exposed through an AI tool.

Even more surprising, 77% of organizations that experienced a data incident said a sanctioned, company-approved AI tool was involved.

This suggests that restricting employees to approved AI platforms is not enough to guarantee data security. Even legitimate business tools can create risks when employees share confidential information without proper safeguards.

For example, employees might enter internal business reports, customer information, sales figures, proprietary designs, or other sensitive material into AI prompts. Without appropriate technical controls, organizations may struggle to prevent that information from being exposed.

BlackFog explained that companies are finding it difficult to balance rapid AI deployment with the need to protect sensitive data.

AI Adoption Is Moving Faster Than Security Controls

The research also highlights a growing gap between AI adoption and corporate governance.

According to the findings:

• 39% of respondents said AI adoption is moving faster than their organizations can govern it.

• Among organizations feeling outpaced, only 27% have comprehensive AI controls in place.

• 98% of organizations reported having an AI usage policy.

• Only 56% support their broader AI policies with comprehensive technical controls.

These figures show that having an AI policy does not necessarily mean a company can enforce it effectively.

Many businesses have established guidelines explaining how employees should use AI, but written rules alone cannot stop someone from accidentally uploading confidential information.

Companies need technical safeguards that can identify risky activity and prevent sensitive data from leaving their systems.

Most Companies Cannot Fully Track What Employees Share With AI

Another major concern identified in the research is the lack of visibility into information being shared with AI platforms.

Although many organizations can identify who is using AI, significantly fewer can determine exactly what information is being transferred.

The survey found that:

• 62% of respondents could identify users or departments sending information to AI tools.

• Only 48% could provide a record of the types of data that had left their organizations through AI tools.

This difference creates a serious challenge for cybersecurity teams.

Knowing which employee or department is using an AI platform is useful, but it does not reveal whether that person has shared customer records, confidential financial information, business strategies, or intellectual property.

Without detailed visibility, security teams may struggle to investigate incidents, understand the extent of exposure, and prevent similar problems from happening again.

Autonomous AI Agents Create New Security Risks

The research also points to another emerging challenge: autonomous AI agents.

Unlike conventional AI tools that mainly respond to user instructions, autonomous agents can perform tasks on behalf of employees. Depending on their permissions, they may access business systems, process information, and carry out actions with limited human involvement.

According to BlackFog's research, 56% of respondents said autonomous AI agents operating on behalf of employees fall outside their organization's existing security controls.

This suggests that many companies have not updated their governance frameworks to account for AI systems that can act independently.

As businesses introduce more autonomous agents into their workflows, they will need to understand what information those agents can access, which actions they can perform, and how their activities are monitored.

Without proper oversight, an AI agent could potentially expose sensitive information or perform an unauthorized action using the permissions granted to it.

Proprietary Designs and Creative Content Are Also at Risk

Sensitive data exposure is not limited to financial records, customer information, or internal business documents.

The research highlights particular weaknesses in protecting proprietary design, creative, and marketing materials.

According to the report:

• 32% of respondents said they can detect or monitor the sharing of this content but cannot consistently prevent it.

• Another 20% primarily rely on written policies or employee training.

This is especially important for retailers, fashion brands, manufacturers, and marketing companies that depend on original designs, creative concepts, product information, and intellectual property.

If employees upload unreleased product designs, campaign materials, or confidential creative assets to external AI platforms, businesses could lose control over valuable information.

Organizations therefore need security measures that protect creative and proprietary content just as carefully as they protect traditional business data.

Why Approved AI Tools Still Need Strong Security

One of the most important lessons from BlackFog's findings is that company-approved AI tools are not automatically risk-free.

Many organizations focus on preventing employees from using unauthorized AI services. However, the research suggests that sensitive information can also be exposed through approved platforms.

Dr. Darren Williams, founder and CEO of BlackFog, emphasized that businesses must look beyond deciding which AI tools employees are allowed to use.

He explained that organizations also need controls over the information employees share with those platforms.

Written policies can establish expectations, but they cannot independently prevent confidential data from being disclosed. Businesses need visibility into data-sharing activity and technical protections capable of stopping unauthorized exposure when it happens.

These protections should cover approved AI platforms, unauthorized services, and autonomous agents acting on employees' behalf.

How Businesses Can Reduce AI Data Security Risks

As AI becomes more deeply integrated into business operations, organizations should take practical steps to improve their security and governance.

Some important measures include:

1. Establish Clear AI Usage Policies

Companies should explain which AI tools employees can use and identify the types of information that must never be entered into AI prompts.

2. Introduce Technical Data Protection Controls

Written policies should be supported by technical safeguards that can detect and prevent unauthorized sharing of confidential information.

3. Monitor AI Usage Across Departments

Security teams should maintain visibility into which employees and departments use AI tools and what categories of information they share.

4. Control Autonomous AI Agents

Organizations should review the permissions granted to AI agents, restrict unnecessary access, and monitor their actions.

5. Protect Intellectual Property

Businesses should establish additional safeguards for proprietary designs, marketing materials, product information, source code, and other valuable creative assets.

6. Train Employees on AI Security

Regular training can help employees understand the risks of uploading sensitive information and recognize situations where AI tools should not be used.

Conclusion: AI Innovation Must Be Matched With Stronger Data Protection

BlackFog's research highlights an important challenge facing modern businesses: AI adoption is accelerating, but security and governance are not always keeping pace.

With 47% of surveyed security decision-makers reporting sensitive data exposure through AI tools, organizations cannot rely on written policies or approved software lists alone.

The involvement of company-approved platforms in 77% of reported incidents makes the issue even more significant. Businesses need to understand not only which AI tools employees use but also what information those tools receive and what autonomous agents can access.

As artificial intelligence becomes a larger part of everyday business operations, strong technical controls, better visibility, and employee awareness will be essential to protecting confidential information and maintaining customer trust.