Shadow AI: Even Google Is Winging It on Security

Everyone is making it up on AI security, including the biggest players. Google Cloud’s COO said it publicly: AI adoption inside organizations creates blind spots that no one is truly managing. Shadow AI, meaning employees using consumer AI tools without organizational oversight, has become the top risk. And Google itself hasn’t cleaned up its own practices.

Key Takeaways

• The breach-to-next-attack timeframe has collapsed from 8 hours to 22 seconds
• Developers were billed over $10,000 in under 30 minutes after a compromised API key was exploited
• Google advocates AI security while maintaining automatic billing upgrades without explicit user consent

Shadow AI: The Blind Spot Inside Every AI Strategy

Francis de Souza, Google Cloud’s COO, stated the issue plainly. Shadow AI is every instance of employees using consumer AI tools without telling their organization: ChatGPT on a personal account, a third-party AI assistant processing customer data, an API connected outside approved workflows. It’s everywhere, and it’s invisible to IT teams.

De Souza’s recommendation is a platform approach: “Security needs to go hand in hand with AI and data strategy from the start, not as an afterthought.” Simple in principle. Difficult in practice when organizations are already accelerating AI deployments without the governance infrastructure to match. For context, see our earlier piece on Horizon: Moltbook: When 1.5 Million AIs Created Their Own Religions.

The attack surface has never been wider. AI agents connect to APIs, databases, and cloud accounts. Every connection is a potential entry point. The average time between a successful breach and the next attack has collapsed from 8 hours to 22 seconds. Human response time is no longer sufficient.

De Souza advocates for “AI-native, fully agentic defense” rather than human-led security responses. Only autonomous systems are fast enough to respond to threats operating at 22-second intervals. The catch: deploying those systems without having secured them first creates a paradox few organizations have resolved.

Our earlier coverage of Project Glasswing highlighted this same tension: even the most advanced systems expose vulnerabilities at the precise moment they are most heavily used. AI security isn’t a problem solved once. It’s a permanent state of vigilance.

When Google Itself Is Part of the Problem

What makes Google’s position particularly notable is the contrast with its own practices. Developer Rod Danan discovered that a compromised API key had generated a bill of $10,138 in under 30 minutes. Isuru Fonseka faced $17,000 AUD in charges despite a $250 spending cap. Both received refunds, but only after media coverage.

In both cases, the compromised API keys remained usable for up to 23 minutes after deletion across Google’s infrastructure. A short window on paper, but at 22 seconds per attack, long enough to generate significant damage.

Google also practices automatic billing tier upgrades without explicit user consent. De Souza recommends full transparency and security by design. Google Cloud’s own billing practices don’t meet those standards.

This isn’t an isolated case. What Google exposes here reflects an entire industry deploying AI ahead of its own governance capabilities. No one is winging it out of bad faith. Everyone is winging it because the standards don’t exist yet.

Shadow AI multiplies this problem at enterprise scale. When an employee uses an unapproved AI tool to process sensitive data, the organization absorbs the risk without even knowing it. It’s a silent exposure, but one whose consequences are anything but quiet. The most recent heavy example: Instagram saw its Meta AI chatbot become an attack vector.

Also on Horizon:

• China cuts 12,000 university degrees made obsolete by AI
• 79% of parents already use AI to raise their kids
• GPT-5.5 Instant beats doctors on health answers

Two Time Horizons, One Immediate Problem

In the near term, Shadow AI incidents will multiply. Not because attackers are more sophisticated, but because the exposed surface is growing faster than supervisory capabilities. Every new AI deployment inside an enterprise without clear oversight is an open door.

For organizations, the immediate priority is inventory. Which AI tools are employees actually using? What data do those tools process? Which APIs are connected to internal systems? The answers to these three questions determine the entire AI security strategy.

In the medium term, regulation will step in. In Europe, the AI Act already mandates system classification and usage traceability. In the US, public incidents like those at Google Cloud are accelerating legislative discussions. Organizations that prepare today build a defensible position. Those that wait inherit the consequences.

The irony is that the solutions exist. Tool inventory, team training, API access reviews, cloud spending monitoring: these are known, documented steps that are often low-cost to implement. What’s missing isn’t knowledge. It’s priority.

Follow the story on Horizon.