In September 2026, we learned that federal regulatory agencies’ websites had fallen prey to the onslaught of so-called “rogue” AI incidents. OpenAI, rumored to have been planning its IPO which would subject it to Securities and Exchange Commission (SEC) regulation, confirmed that its not-ready-for-prime-time sandbox players had “meddled” with several government websites, including SEC.gov, during model training and testing.

While OpenAI found no evidence of the hallmarks of traditional cyber-attacks – unauthorized account access and breach of non-public data – it acknowledged that its technology unexpectedly pulled publicly-available information from the SEC’s website and posted it elsewhere on the web.

OpenAI had not directed its agents to take these actions, making this yet another of the recently revealed cases of model misalignment involving sandbox AI agents. Notably, just a few months earlier, a corporate cybersecurity incident disclosure was filed with the SEC stemming from the use of “shadow AI,” aka unsanctioned employee use of AI tools. The juxtaposition of these two SEC AI-related events highlights a serious vulnerability for both public and private companies.

As AI agents continue to behave unpredictably, it becomes even more critical for public and private companies to address shadow AI use in the workplace.

First Shadow AI-Related Material Event

In what is believed to be the first Form 8-K filing with the SEC arising out of shadow AI, on May 11, 2026, CB Financial Services, Inc. disclosed a material cybersecurity incident at its subsidiary, Community Bank, resulting from the use of an “unauthorized artificial intelligence-based software application.”

Even though the shadow AI incident didn’t disrupt the bank’s operations and wasn’t expected to have a material impact on its consolidated financial condition, the company deemed it to be a material event due to the “volume and sensitive nature of the non-public information” that was disclosed, which included personally-identifiable information (PII), such as customers’ names, social security numbers and birthdates.

Most likely, an efficiency-seeking employee uploaded bulk PII to an AI chatbot outside the bank’s governance policies. And that efficiency-driven employee is not alone.

The problem of shadow AI has grown in lock-step with the rise of AI adoption, as corporations struggle to balance AI deployment, training, and best practices. AI adoption is clearly outpacing oversight, as IBM points out in its 2026 Cost of a Data Breach Report, security incidents involving shadow AI more than doubled to 43% in 2026 from 20% in 2025.

Given that two-thirds of office professionals report having used AI tools or services at work despite believing that company policy prohibited them from doing so, and fuzzy personal AI assistants are getting downloaded at hyperspeed, it follows that shadow AI will continue to lead to material cybersecurity incidents.

Legal and Regulatory Risks Cannot Be Ignored

Recognizing the need for the investing public to be informed about cybersecurity incidents, in 2023, the SEC adopted rules focused on board of directors and management accountability for cybersecurity.

The rules require public companies to file Form 8-K disclosures within four days of determining that they have experienced a material cybersecurity incident and to disclose information regarding their cybersecurity governance programs in their annual reports (Form 10-K), including descriptions of the board’s oversight of cybersecurity risks and management’s role in identifying and addressing material risks from cybersecurity threats.

The dramatic increase in the use of AI, even prior to the widespread corporate adoption of AI agents, coupled with the recent shadow AI SEC 8-K filing, underscore the need for companies to re-focus on best practices.

Whether shadow AI use is the result of employees disliking company-chosen enterprise solutions, or a gap in governance that enables unchecked use of enterprise solutions (copying-and-pasting PII into even a sanctioned platform could trigger legal obligations if the principle of least privilege is not enforced), the legal and regulatory risks are too great to be ignored.

C-Suiters, general counsels, and board members must understand how employees are using AI in the workplace. And October is Cybersecurity Awareness Month: a perfect time to evaluate existing AI policies and procedures to identify why they have failed to reduce shadow AI’s popularity. In addition to overhauling these policies, implementing effective auditing frameworks and accountability for fixing deficiencies identified in those audits is critical.

And since the risk is not limited to lower-level employees, deep-seated technical workarounds must be revealed as well. Senior management is often guilty of attempting to circumvent security best practices (besides the fact that cybersecurity leaders can make bad choices, recent polls have found that executives are actually more than twice as likely to use unapproved AI tools than the employees they manage).

These risks will only increase as companies rush to adopt AI agents without fully appreciating or accounting for the consequences of their unpredictability. Companies are wise to get a handle on shadow AI now, in advance of the inevitable federal government regulation of AI agents and before the actions of an AI agent or employee using an unsanctioned AI tool (or misusing a sanctioned AI tool) force disclosures to the SEC, investors and the plaintiff’s bar.

AI tools are only becoming more powerful, as recent adventures outside of the sandbox have illustrated – companies must shine the light on shadow AI.