Shadow AI is already inside the enterprise, whether IT approved it or not. Employees paste contracts, source code, credentials, incident data and internal conversations into chatbots, coding assistants and meeting bots with little visibility into where that data goes or who can access it later. This talk looks at how AI creates new exfiltration paths, how enterprise AI can magnify years of broken permissions and oversharing, and why “approved AI” is not automatically “safe AI.” Through practical examples, we will examine how quickly convenience defeats policy, DLP and common sense, and why organizations rushing to deploy AI may be creating a data-leakage problem they barely understand.