Shadow AI at work: what employees paste

"Shadow AI" means people using AI tools for work without their organisation having approved or set them up. It is a normal result of useful tools being one browser tab away. This page looks at what one survey found people paste into public chatbots, and what that means for everyday habits. It makes no claim beyond that survey.

What one survey found

The 2026 PagerDuty Shadow AI Survey, carried out by Wakefield Research, polled 1,250 office professionals at companies with at least $500M in revenue, in Australia, Japan, the UK and the US, between April 9 and 20, 2026. According to that survey:

  • 43% reported putting work correspondence into public AI chatbots.
  • 34% reported putting customer data into them.
  • 31% reported putting financial information or confidential company documents into them.

This is one survey, of a specific group of people, at one point in time, and the figures are what respondents reported. They do not describe every workplace, and this site has no data of its own to add. Read the original post for the full method and wording.

Why it matters in practice

Work text tends to contain more than it seems to. An email thread has names, addresses and phone numbers. A support export has customer details. A finance sheet has account numbers. A code snippet has a token somewhere near the top. The person pasting is usually trying to save time on a boring task, and the sensitive part is incidental.

That is the key point: the risk is rarely a decision to share secrets. It is a copy-and-paste of something that happened to include one.

Habits that reduce the risk

  1. Know your organisation's rule. Many workplaces have an approved tool or a policy. Follow it. This page is not a substitute.
  2. Ask what the task needs. Often a summary, a structure or three invented examples is enough.
  3. Remove identifiers first. Names, numbers, addresses, account details and keys.
  4. Prefer placeholders. Replace real values with labels like CUSTOMER_1, and map them back yourself.
  5. Keep the whole file out. Paste the paragraph or the function, not the document.
  6. Tell your team what works. Shared habits beat individual caution.

Where a paste check fits

A tool that checks at the moment of pasting covers one specific gap: the accidental extra. Paste Guard runs in Chrome and looks at text you paste into supported AI chat sites. If it finds an email address, phone number, card number, Aadhaar, PAN, UPI ID, API key or similar, it pauses and offers a masked paste, a paste as-is, or a cancel. It works on your device, makes no network requests, and has no account.

It does not manage what your organisation allows, it does not log or report what you paste, and it cannot see anything outside the supported sites. It is a personal safety net for individuals, not a governance tool.

Limits

  • It recognises patterns, so names, free-text descriptions and confidential content with no fixed format will not be caught.
  • It sees text, not images or attachments.
  • It watches pastes, not typing or file uploads.
  • It can occasionally flag something harmless, and you can ignore that value.

You can see exactly what it would catch in your own text on the scanner page. Nothing you type there is uploaded, which you can confirm in your browser's Network tab.