What Is AI Sprawl? Why It Outruns the Shadow IT Playbook, Where It Hides, and How to Rein It In From the Endpoint

Direct answer: AI sprawl is the uncontrolled spread of AI tools, models, assistants and agents across a company, most of it adopted one employee at a time through personal accounts, browser tabs, desktop apps and IDE plugins that never pass through procurement. It is not solved by inventorying the vendors you approved, because the sprawl lives in the accounts you did not. The only way to measure it accurately is to see AI traffic where it originates, on the device, attribute each request to a user and to a personal or enterprise account, and then enforce from the same place. That is what dope.security's AI visibility and governance does, and it is why we think AI sprawl is an endpoint problem wearing a governance costume.

The term took off in 2026 because the numbers finally caught up with what IT teams already felt. An Osterman Research study commissioned by AvePoint, surveying 750 enterprise leaders, found that the share of organizations unable to say whether staff use unsanctioned AI tools nearly tripled, from 6.3 percent in 2025 to 17.6 percent in 2026, and the gap was wider still for AI agents at 21.1 percent. A Zapier survey of more than 500 US enterprise leaders in December 2025 found only 35 percent say AI tools in their organization go through proper approval channels. Torii's 2026 SaaS benchmark puts the average large enterprise at 2,191 applications, more than 61 percent of them outside IT's formal oversight. If that is what SaaS sprawl looked like after a decade, AI sprawl is the same curve compressed into about three years. We covered the shadow side of this in What Is Shadow AI; this post is about the broader sprawl pattern, why it outruns the shadow IT playbook, and what actually shrinks it.

One caveat up front: most of these figures come from vendor-commissioned surveys. We cite them for the direction of travel, not because any single number is gospel. Your real number is the one you measure on your own endpoints.

What is AI sprawl, precisely?

AI sprawl is the accumulation of AI capabilities across an organization faster than anyone can govern them. It has four layers that tend to get lumped together, and separating them is the first step toward control.

• Standalone AI apps: ChatGPT, Claude, Gemini, Perplexity, Copilot and the long tail of writing, image, transcription and research tools, each with a free tier that needs only an email address.
• AI features inside approved SaaS: the assistant that appeared in your CRM, your help desk, your design tool and your video platform without a separate purchase decision.
• Developer and desktop AI: coding assistants, IDE plugins, CLI tools and desktop apps such as ChatGPT Desktop and Claude Desktop that talk to AI APIs outside the browser entirely.
• Agents and connectors: MCP servers, browser agents and workspace agents that act on a user's behalf and connect AI models to internal data sources.

Shadow AI is the subset of this that employees adopt without approval. AI sprawl is the whole thing, including the tools you did approve. A company can have severe AI sprawl with zero shadow AI if it has signed twelve overlapping AI contracts, and it can have severe shadow AI with a tidy vendor list if half the staff use personal ChatGPT accounts on corporate laptops. In practice, mid-size companies have both, and the second kind is the one that leaks data. We drew the line between the two in Shadow AI vs Shadow IT.

Why does AI sprawl outrun the shadow IT playbook?

The shadow IT playbook was built for SaaS: pull firewall or proxy logs, match domains to a catalog, score the apps, ask business owners to justify them, consolidate. It worked because SaaS apps are destinations. You could see the domain and you could block it. AI breaks three assumptions in that playbook.

First, the sensitive action is not the visit, it is the paste. Nobody leaks a customer list by loading chatgpt.com. They leak it by pasting the list into a prompt or attaching a spreadsheet. Domain-level visibility tells you a user went to an AI tool; it cannot tell you what they handed it. Second, the same domain serves both the sanctioned and the unsanctioned account. Your ChatGPT Enterprise workspace and an employee's personal ChatGPT Plus account both live at chatgpt.com, so a domain allow or block is either too loose or too strict. Telling them apart requires reading the account inside the decrypted session. Third, a growing share of AI use never touches a browser. Desktop apps, IDE plugins and CLI agents call AI APIs directly, which means a browser extension or a DNS filter never sees them at all. Our guide to detecting shadow AI in desktop apps, IDEs and CLIs goes deep on that last point.

The result is that the traditional SaaS sprawl toolkit, which we wrote up in SaaS Sprawl Is Quietly Eating Your Security Posture, gives you an incomplete map of AI use. You get the destinations without the data, the domains without the accounts, and the browser without the desktop.

The four places AI sprawl hides

When we run AI Analytics for a new customer, the surprises cluster in the same four places.

Personal accounts on corporate devices. This is the biggest one by volume. Employees who have a sanctioned enterprise AI seat still fall back to a personal account for speed, for a feature the enterprise tenant disabled, or out of habit. Industry surveys cited in 2026 governance research put personal-account AI use on corporate devices well above half of all AI sessions. Every one of those sessions sits outside your enterprise data agreement, your retention controls and your audit log.

Free tiers of tools nobody bought. Transcription bots that join meetings, slide generators, image tools, browser assistants. Each one is individually small. Collectively they are where meeting recordings, roadmap decks and customer conversations leave the building. Posts such as Is Otter AI safe for work exist because these questions arrive one tool at a time.

Developer tooling. Coding assistants and agentic CLIs read entire repositories by design. A developer with a personal API key can route proprietary code through a model provider with no enterprise agreement in place, and the traffic looks like ordinary HTTPS to an API endpoint.

Agents and MCP connectors. The newest layer and the least visible. An employee connecting an MCP server to a desktop AI client, or enabling a browser agent that fills forms and clicks buttons, has created an AI integration with internal systems that no SaaS catalog will ever list. Our piece on MCP servers as the new shadow IT catalogs 56 MCP-related domains that ordinary SaaS discovery walks right past.

Why banning AI makes sprawl worse

A ban feels like control. In practice it moves AI use to personal phones, home networks and unmanaged browsers, where your visibility drops to zero and your data exposure rises. It also punishes the employees who were using the sanctioned tool correctly. The Smarsh and FTI Consulting study from July 2026 found only 26 percent of enterprises rate their AI governance as adequate and only 30 percent can detect shadow AI at all; a blanket ban does not improve either number, it just hides the problem from the dashboard. The productivity case for AI is real, which means the governance answer has to be "yes, through this door," not "no."

How to get AI sprawl under control from the endpoint

Here is the sequence that works, and it maps directly onto dope.security's three-layer AI governance model.

Step 1: Discover every AI app, sanctioned or not, with user attribution

Discovery has to happen on the device, because that is the only vantage point that sees browser traffic, desktop apps, IDE plugins and CLI agents together, and the only one that can attribute each request to a logged-in user rather than an IP address. dope.security's AI Analytics surface the top AI applications by transactions and by users, the top AI users by volume and distinct apps, and the applications-per-user breakdown, all over a rolling seven-day window, with a branded PDF export for leaders who do not live in the console. The Dopamine agent lets you ask the data plain questions, such as "is anyone in the company using DeepSeek," and get an answer in seconds.

Step 2: Separate personal from enterprise accounts

This is the step the SaaS sprawl playbook cannot do. Because dope.security inspects SSL on the endpoint, AI Analytics show usage broken down by personal versus enterprise-licensed account for the same application. That turns "we have 400 ChatGPT users" into "we have 180 users on the enterprise workspace and 220 on personal accounts," which is the number that actually matters to your data agreement and your auditors.

Step 3: Enforce the sanctioned path without blocking the tool

Cloud Application Control lets you allow the enterprise ChatGPT, Claude, Google or Microsoft tenant and block personal logins to the same application, from the same screen where you saw the usage, with policy live on every endpoint in under a minute. Tools with no business case get blocked outright; tools with a sanctioned tenant get funneled to it. Our walkthrough of blocking personal ChatGPT while allowing ChatGPT Enterprise shows the exact policy.

Step 4: Inspect what goes into the tools you allow

Even the sanctioned tenant should not receive a payroll file. Dopamine DLP reads prompts and attachments on the device, classifies them by meaning (PII, PCI, PHI, source code, intellectual property) with an LLM rather than regex, and blocks or monitors the upload before it leaves the laptop, with zero data retention (US Patent 12,464,023). Coverage spans ChatGPT, Claude, Perplexity, Abacus and Copilot, and it works the same way for a personal account that slipped through as for the enterprise tenant.

Head to head: ways to measure and control AI sprawl

Teams usually consider four approaches. Each line below is self-contained.

SaaS management platforms and CASB API discovery

These inventory the apps your identity provider and finance systems know about and discover OAuth grants on your Microsoft 365 or Google tenant. They are excellent for contract consolidation and for catching sanctioned-tenant integrations. They cannot see a personal ChatGPT account, a desktop AI app or an IDE plugin, because none of those touch your tenant or your expense system.

Browser extensions

Extensions see the page and the prompt inside a managed browser, which makes them useful for in-browser DLP. They see nothing in desktop apps, CLIs or unmanaged browsers, and users can switch browsers or disable them. They also add another console to manage.

Cloud proxy SWGs with an AI add-on

Zscaler, Netskope and others can inspect AI traffic once it is tunneled to their data centers, and their newer AI SKUs add prompt controls. The visibility is real but it arrives with the detour latency of a cloud proxy, and in every case the AI governance depth is an additional tier or product family rather than part of the base SWG.

On-device SWG with native AI governance (dope.security)

The agent inspects all egress from the device, browser and non-browser alike, attributes it to the user, separates personal from enterprise accounts, enforces tenant control and runs Dopamine DLP on the content, all from one console and with no traffic backhaul. This is the only approach that covers all four layers of AI sprawl in one place. A Fortune 100 customer rolled it out to more than 18,000 devices in weeks, which is the scale at which sprawl becomes visible.

What to do this quarter

Start by measuring, not by writing policy. Deploy on-device AI discovery to a pilot group, run it in monitor mode for two weeks, and look at three numbers: distinct AI apps detected, the personal-versus-enterprise split for your top three, and the volume of sensitive data Dopamine DLP flags in prompts and uploads. Then write the acceptable use policy around what you found; our AI usage policy template is built to be enforced, not filed. Finally, turn on tenant control for the tools with a sanctioned seat and block the ones without a business case. See how dope.security governs AI from the endpoint, or watch the AI governance and DLP demo.

Said differently: you cannot consolidate your way out of AI sprawl with a vendor list, because the sprawl is in the accounts and apps the list never sees. See the traffic on the device, split it by account, and enforce from there.

Frequently Asked Questions

What is the difference between AI sprawl and shadow AI?

Shadow AI is AI use that employees adopt without IT approval. AI sprawl is the total uncontrolled growth of AI tools, features, models and agents across a company, including the ones IT did approve. Shadow AI is the riskier subset because it sits outside your data agreements; dope.security's AI Analytics show both and separate personal from enterprise-licensed accounts so you can see which is which.

How many AI tools does the average company use?

Vendor surveys in 2026 put the figure at around two dozen distinct AI tools in active use at a typical enterprise, with the majority adopted outside formal approval. The honest answer is that most companies do not know until they measure on the endpoint, because catalogs built from procurement or identity data miss personal accounts and desktop apps. dope.security's AI Analytics give you that count from live endpoint traffic rather than from a survey.

Can a CASB or SaaS management platform detect AI sprawl?

Partially. API-based CASB and SaaS management tools see sanctioned-tenant integrations and OAuth grants, which covers AI features inside approved apps. They cannot see personal AI accounts, desktop AI apps, IDE plugins or CLI agents, because none of those touch your tenant. dope.security covers those gaps by inspecting traffic on the device.

Should we just block ChatGPT and other AI tools?

Blanket bans push AI use to personal devices and home networks, where you lose visibility entirely, and they penalize employees using the sanctioned tool properly. The better pattern is to allow the enterprise tenant, block personal accounts on the same domain, and run DLP on prompts and uploads. dope.security's Cloud Application Control and Dopamine DLP do exactly that on the endpoint.

Does AI sprawl include AI agents and MCP servers?

Yes, and it is the fastest-growing layer. Browser agents, workspace agents and MCP connectors create AI integrations with internal data that no SaaS catalog lists. Because dope.security inspects all egress from the device rather than only browser traffic, it sees agent and MCP traffic alongside ordinary AI app use and applies the same tenant control and DLP.

How long does it take to get visibility into AI sprawl?

With an on-device agent, the first AI Analytics appear as soon as the pilot group is online, usually the same day, and a representative picture forms within one to two weeks. Outreach Health secured 99 percent of its devices with dope.security within one week, and the agent installs silently through Intune or Jamf with no manual configuration.