The endpoint is the new AI perimeter.
Emerging risks of employee AI use in 2025 and 2026: what the security market covers, where it stops, and what a complete control requires.
Executive summary
Five conclusions from the evidence.
The paper brings together vendor telemetry, surveys, incident reports and security frameworks published between January 2025 and September 2026 into a single risk register for employee AI use on business endpoints. The October edition updates every Lamplighter status to version 0.18, from an internal audit of the product’s code and automated tests.
The endpoint is now the control point.
The fastest-growing AI surfaces (coding agents, local MCP servers, desktop assistants and AI browser extensions) generate no network event a proxy or cloud access broker can inspect. Only software on the workstation sees who is using which AI, with which account, on what data, and where that data came from.
Shadow AI is an account problem, not a domain problem.
The same web address carries different training, retention and legal-discovery consequences depending on which account is signed in. Consumer-tier chats were swept into court-ordered preservation in 2025; enterprise tiers were carved out.
AI tools are now attack vectors in their own right.
Fake AI installers, chat-harvesting extensions, poisoned models, malicious MCP servers and worms that hijack the victim’s own AI command-line tools are all documented in the period.
Prompt injection is a design assumption, not a bug.
Vendors and national agencies now say it is unlikely ever to be fully solved. Defensible controls act on what an agent is allowed to do, not on filtering what it reads.
Governance is mostly a policy and evidence problem.
Gartner attributes at least 80% of unauthorised AI transactions to internal policy violations rather than attacks, and regulators increasingly ask for inventories, literacy records and usage logs. A tool that captures prompts is itself workplace monitoring, so the control must be lawful by design.
Key findings
What changed in 2025 and 2026.
of organisations now have agentic coding tools in use, up from 42% a year earlier. Local MCP traffic from these tools is invisible to network sensors.
[1] Netskope AI report 2026of pastes into generative AI come from unmanaged, personal accounts. 22% of pastes carry personal or payment data.
[2] LayerX, 2025CVEs were published for MCP-related software in 2025 alone. Agent configuration files have become an execution layer.
[4] Microsoft AI Red Team; [5] Check Pointinstalls of two “AI assistant” browser extensions that harvested ChatGPT and DeepSeek conversations across more than 20,000 enterprise tenants.
[3] Microsoft Threat Intelligenceof AI data-policy alerts are now “downstream”: the assistant returning data the user should not see, up from effectively zero a year earlier.
[1] Netskope AI report 2026added to the average cost of a breach with high shadow-AI involvement. 97% of organisations breached through AI lacked proper AI access controls.
[6] IBM and Ponemon, 2025Figure 1
Where data reaches AI from the endpoint, and which sensor can see it.
| Route | NetworkSWG, SSE, CASB | Browserextension | Endpoint agentprocess, file, clipboard | Cloud APIvendor audit logs |
|---|---|---|---|---|
| Prompt typed or pasted into an AI web app | partial | sees content and context | partial | partial |
| File uploaded to an AI web app | partial | sees content and context | partial | partial |
| Paste or file into a desktop AI app | partial | does not see | sees content and context | partial |
| Coding agent or CLI calling a model API | partial | does not see | sees content and context | partial |
| Local MCP servers and their tool calls | does not see | does not see | sees content and context | does not see |
| Browser extension reading AI conversations | does not see | partial | partial | does not see |
| AI embedded in an approved SaaS app | partial | partial | partial | sees content and context |
| Operating-system AI, such as screen capture | does not see | does not see | sees content and context | does not see |
| Conversation published through a share link | partial | sees content and context | does not see | partial |
| AI response returning restricted data | partial | sees content and context | partial | partial |
| OAuth consent to an AI connector | partial | sees content and context | does not see | partial |
| Agent exfiltrating from the vendor’s cloud | does not see | does not see | does not see | partial |
What the market covers, and where it stops
Chat in the browser is well served. Four gaps are documented.
Discovery, account-aware policy and inline inspection of chat applications in the browser are now table stakes. The research found four gaps that are documented rather than merely asserted.
Desktop, command-line and local MCP agents
The most-cited residual gap of 2026. Agents generate no network events, and gateway approaches miss local MCP servers, IDE agents and desktop apps.
Extension-level interception
Extensions read AI conversations inside encrypted sessions and leave over ordinary HTTPS, invisible to network, CASB and EDR controls.
Identity ground truth
With 68% of corporate logins made without single sign-on, identity controls often cannot tell which account is in use.
A route to yes
No vendor documentation reviewed evidenced a request, approval and exception workflow. Blocking without one moves AI use rather than reducing it. Lamplighter now ships a first version.
The acquisition signal
Between mid-2025 and mid-2026 every major security platform bought at least one AI-security company. The 2025 deals bought the chat layer; the 2026 deals moved to agents and identities.
| Acquirer | Target | Announced | Capability acquired |
|---|---|---|---|
| SentinelOne | Prompt Security | Aug 2025 | Shadow-AI discovery, prompt inspection, MCP gateway |
| Cato Networks | Aim Security | Sep 2025 | AI runtime security |
| Check Point | Lakera | Sep 2025 | Prompt-injection and jailbreak detection |
| CrowdStrike | Pangea | Sep 2025 | AI detection and response guardrails |
| Zscaler | SPLX | Nov 2025 | AI red teaming and runtime protection |
| Palo Alto Networks | Koi | Apr 2026 | Agentic endpoint security |
| Cisco | Astrix Security | May 2026 | Non-human identity and agent credentials |
Ten requirements
What a complete control must do, and how we score against it.
The requirements are stated independently of any product so they can be used to evaluate any vendor, including us. Statuses are Lamplighter v0.18 (October 2026), drawn from an internal audit of the product’s code and automated tests.
Discover every AI touchpointNIST IR 8596 · ISO/IEC 42001 A.9 · ETSI Principle 5
Available: AI websites against a signed catalogue, desktop apps and CLIs by process, browser and IDE extensions, local runtimes, and MCP servers in ten clients. Roadmap: AI inside approved apps and the operating system.
Identify the account and edition, and enforce tier policyISO/IEC 42001 A.9
Available: Corporate or Shadow on eight of the most-used AI web apps, from the vendor’s own workspace signal. Roadmap: Corporate confirmed against your registered domains; vendor posture. Proposed: sessions outside single sign-on.
Classify content on the device, on every routeOWASP LLM02 · ISO/IEC 27001 A.8.12
Available: validators and an on-device classifier, sensitivity labels, code fingerprints, the browser, coding agents, the Windows desktop paste gate and file-open control. In development: text in images. Proposed: AI responses.
Keep user content on the device, and monitor proportionatelyUK ICO monitoring guidance · EU AI Act Art. 5
Available: no content leaves by default, no keystroke logging, a notice before enrolment, real deletion, an optional pseudonymised window, and sealed evidence only the customer can open.
Govern connections and actions at the action layerOWASP ASI02–ASI05 · NCSC
Available: policy over MCP servers, OAuth grants, keys and agent modes, and the MCP gateway for local servers. Roadmap: enforced allowlists, remote servers, agent guardrails. Proposed: the consent screen.
Treat the AI tool as a potential attack vectorOWASP LLM03, ASI04 · MITRE ATLAS
Available: extension and runtime inventory, AI CLIs launched with their safeguards off. Roadmap: agent supply-chain scanning. Proposed: CVE matching and command guards.
Attach AI provenance to consequential actionsOWASP LLM09
Available: the source application of every paste into AI, on Windows. Proposed: package-install guard, secrets in AI-assisted commits.
Coach before blocking, and provide a route to yesISO/IEC 42001 A.5, A.9
Available: log, coach and block with reasons and 30-day simulation, and requests from the notice that change enforcement on every device once approved. Roadmap: approval per data type. Proposed: literacy records.
Produce the evidence auditors request, and reuse what you ownISO/IEC 27001, 42001 · EU AI Act Art. 4
Available: board reports, SIEM export, AppLocker, Purview and gateway lists. Roadmap: an ISO/IEC 42001 workbook and audit pack.
State the boundaries and prove coverage on your own estateETSI Principle 12
Available: every device attests its protections, and a self-test proves each one on demand. In development: the end-to-end scenario suite. Roadmap: a coverage digest.
Figure 2
Endpoint AI control features, of 30.
Seventeen vendors scored against 30 features from their public documentation, in full and in part. Lamplighter is held to the same rule: a feature counts in full only when every element of its definition works today.
Vendor figures count capabilities evidenced in public documentation reviewed in September 2026. Lamplighter’s figures are mapped from an internal audit of v0.18 against its code and tests in October 2026, not from third-party review, and absence of documentation is not proof that a vendor lacks a capability. The evidence behind every vendor score is on the coverage page.
What comes next
The engineering plan, in four groups.
From section 7.5 of the paper. Dates are not committed, and items marked proposed are under consideration but not yet scheduled.
The desktop and account picture
Corporate accounts confirmed against your registered domains, OCR on the desktop clipboard, every desktop route recorded end to end, a protection-coverage digest, and the file-driver licence delivered to each device automatically.
Detection quality
A pre-trained encoder for the on-device classifier, reading past the first window of long documents, and analysts’ false-positive decisions feeding the evaluation set.
Closing the remaining routes
Approval per tool and per data type with the requester told the outcome, blocking a blocked tool’s page with the approved alternative named, and executable denial through the file driver.
Running it without help
Online purchase, onboarding in the browser, a downloads page, Microsoft 365 connected in a single consent, and the browser-store listings.
The limits of any endpoint control
A claim of completeness is only defensible if it is bounded.
Server-side exfiltration
Hidden instructions in an e-mail made a cloud research agent send personal data from the vendor’s own servers. No endpoint or network control could see it.
Unmanaged devices and phones
Endpoint agents instrument managed computers. Tenant restrictions, conditional access and single sign-on are the complementary controls.
Vendor-side retention and training
A vendor’s training settings, retention, human review and litigation holds are invisible to any endpoint. The endpoint identifies which regime applies.
AI embedded in approved SaaS
AI features inside an approved product produce no distinguishable endpoint event. The answer is the vendor’s own audit and compliance interfaces.
Confidence cannot mean prevention of a threat class its own vendors say cannot be fixed. It means demonstrable control of a behaviour, containment of what cannot be prevented, and evidence of both that stands up to an auditor, a regulator and a works council.Conclusion, section 8
Get the paper
33 pages, 119 sources, and the full 79-risk register.
The PDF includes the risk register with framework references for every risk, and the OWASP coverage map. The register with full mappings is available on request.
PDF · 33 pages · A4 · 680 KB
Sources cited on this page
- [1]Netskope Threat Labs, “Netskope AI report 2026”
- [2]LayerX Security, “Enterprise AI and SaaS data security report 2025”, as reported by The Register
- [3]Microsoft Threat Intelligence, “Malicious AI assistant extensions harvest LLM chat histories”, March 2026
- [4]Microsoft AI Red Team, “Updating the taxonomy of failure modes in agentic AI systems”
- [5]Check Point Research, “RCE and API token exfiltration through Claude Code project files (CVE-2025-59536)”
- [6]IBM and Ponemon Institute, “Cost of a data breach report 2025: the AI oversight gap”
- [14]Gartner, “Market guide for AI trust, risk and security management”, February 2025
- [17]Information Commissioner’s Office, “Employment practices and data protection: monitoring workers”
See the requirements met on your own machines.
A 30-minute call and a live demo on Windows, mapped to the ten requirements.