Enterprise AI deployment has leapt into mainstream operations, but recent data shows it’s not the casual user that’s generating the most risk—it’s a small cohort of AI super-adopters. According to a new report from Akamai, the top 5% of power users engage with AI models about 12 times more than the bottom half of the workforce ([thehackernews.com](https://thehackernews.com/2026/08/the-outsized-shadow-why-5-of-ai-users.html)). These users aren’t just drafting emails—they’re embedding unvetted tools into mission-critical workflows, expanding shadow AI environments, and exposing the business to data leaks and governance gaps.
What the Data Reveals
The report, based on real-world telemetry, finds that while most employees average around five prompts per AI session, power users regularly interact with AI 18 times or more per session ([thehackernews.com](https://thehackernews.com/2026/08/the-outsized-shadow-why-5-of-ai-users.html)). Nearly half—47.11%—of enterprise AI talks happen through personal rather than corporate accounts, creating blind spots for IT and security teams ([thehackernews.com](https://thehackernews.com/2026/08/the-outsized-shadow-why-5-of-ai-users.html)).
Some tools fare worse than others. While enterprise-grade platforms like Gemini Enterprise (98.15%) and Microsoft Copilot M365 (90.55%) are mostly confined to corporate-managed logins, freemium tools—DeepSeek, ChatGPT, Claude—and standard account versions of Copilot are dominated by personal logins ([thehackernews.com](https://thehackernews.com/2026/08/the-outsized-shadow-why-5-of-ai-users.html)). And even when employees sign up using work email addresses, about 14.4% of these accounts are tied to free or freemium models outside enterprise licensing, which may feed data into public training pools ([thehackernews.com](https://thehackernews.com/2026/08/the-outsized-shadow-why-5-of-ai-users.html)).
Growing Threat Vectors: Extensions, Agents & Niche Tools
Bigger organizations tend to focus on headline tools like ChatGPT or Copilot but are overlooking the “long tail” of less visible AI utilities. Employees regularly adopt niche AI tools, browser or IDE extensions, and autonomous agents without oversight. In midsize companies, 17.7% of people use at least one AI extension; in larger firms, roughly 9.5% do ([thehackernews.com](https://thehackernews.com/2026/08/the-outsized-shadow-why-5-of-ai-users.html)). Nearly three-quarters of those extensions request high or critical system permissions ([thehackernews.com](https://thehackernews.com/2026/08/the-outsized-shadow-why-5-of-ai-users.html)).
Alarmingly, 16.31% of AI extensions contain known vulnerabilities (CVEs), whereas browser extensions broadly register about 10.80% ([thehackernews.com](https://thehackernews.com/2026/08/the-outsized-shadow-why-5-of-ai-users.html)). These gaps in visibility form what Akamai dubs “Shadow AI,” which combines risks of data breach, unauthorized access, and misuse of internal credentials or source code ([thehackernews.com](https://thehackernews.com/2026/08/the-outsized-shadow-why-5-of-ai-users.html)).
The CISO Imperative & Strategic Checklist
Security teams must now shift their focus: they’re no longer asking whether employees are using AI—they know—they must find out where, how deeply, and how securely AI is integrated across the enterprise ([thehackernews.com](https://thehackernews.com/2026/08/the-outsized-shadow-why-5-of-ai-users.html)). Before attackers do.
Akamai’s report delivers a checklist for this purpose:
- Establish real-time visibility over AI apps, agents, browser/IDE extensions; monitor prompts and data inputs.
- Eliminate shadow AI: enforce SSO, block personal logins, audit corporate emails used in freemium tools.
- Implement contextual AI data loss prevention to catch leaks in unstructured formats.
- Audit extensions: track permissions, inventory all add-ons, scan for CVEs.
- Govern AI agents like privileged identities: limit scope, enforce minimal necessary access, and monitor them.
Several specific attack paths illustrate the risks uncovered: “Vibe Hacking” (modifying local instruction files to manipulate AI assistants), “CursorJacking” (using extensions to extract API keys or internal code), and “CometJacking” (prompt injection via malicious web content to harvest local files) ([thehackernews.com](https://thehackernews.com/2026/08/the-outsized-shadow-why-5-of-ai-users.html)).
These aren’t theoretical—each represents an active vulnerability vector enabled by tools already running in many organizations.
This rising tide of risk underscores the urgency of proactive governance. It’s no longer sufficient for enterprise security to set policy and hope for compliance—it must map where AI tools are deeply embedded, preempt possible misuse, and lock down the weak points in the fabric of internal systems.
Analysis: The most serious security gaps are no longer random—they cluster around those who use AI deeply and frequently. AI super-adopters magnify exposure not just by volume of use but by complexity: they layer together extensions, personal and freemium tools, and agents that operate outside unified control. For CISOs, this means visibility is only the first hurdle—real security depends on governance that accounts for human behavior, tool diversity, and the messy reality of modern workflows. Enterprises that treat these super-adopters not as fringe but as central will manage risk far better.
