The 5% Problem: Why Your AI Power Users Are Your Biggest Security Headache
Enterprise security teams are playing the wrong game. While they're busy writing policies about ChatGPT and wrestling with Claude access requests, a small group of employees is quietly embedding unvetted AI tools into the fabric of how the business actually runs.
New research from Akamai puts numbers to something many CISOs probably suspect but can't yet see clearly. The top 5% of enterprise AI users interact with models at 12 times the rate of the bottom half of the workforce. These aren't people asking AI to fix a subject line. They're running extended, multi-step workflows with AI embedded at every stage.
The average employee conversation runs about five prompts. Power users routinely hit 18 or more. At that level, AI isn't a convenience feature. It's a working dependency, baked into processes that the security team may know nothing about.
Akamai's Or Eshed, VP of Enterprise Security Product and Engineering, frames it plainly: "AI is no longer just a productivity booster; it is a virtual colleague with keycard access to the company vault."
Shadow AI Is Feral AI
Almost half of all enterprise AI conversations (47%) happen through personal accounts rather than corporate-managed identities. That's a significant chunk of business activity sitting entirely outside IT's line of sight.
The split between platforms is telling. Gemini Enterprise and Microsoft Copilot M365 keep the overwhelming majority of their interactions inside corporate identity systems (98% and 90% respectively). ChatGPT, Claude, and DeepSeek skew heavily toward personal logins.
Then there's the awkward middle ground: 14.4% of enterprise AI conversations go through corporate email addresses attached to personal freemium subscriptions. The employee looks like they're using an official account. The data they're feeding into prompts may be training public models. Nobody flagged it.
Eshed describes this as one of the more unexpected findings in the research, and it's easy to see why. It's the kind of gap that doesn't show up cleanly in access logs or identity reports.
The Long Tail Nobody's Watching
Focusing governance effort on the four or five major frontier AI platforms is understandable but increasingly insufficient. Employees are pulling in niche AI tools, AI-powered SaaS apps, and browser extensions at a pace that makes traditional software auditing look quaint.
Browser and IDE extensions are a particular problem. Akamai found that 17.7% of employees at midsize companies have at least one AI extension installed, with 75% of those requesting high or critical permissions. More damaging: 16.3% of AI extensions carry known CVE vulnerabilities, compared to 10.8% for browser extensions broadly.
These aren't theoretical risks sitting in some sandbox. They're running inside active user sessions, with direct access to whatever data those sessions touch.
New Attacks for a New Surface
The expanded AI footprint has opened up attack vectors that weren't on anyone's radar two years ago. Akamai's report names a few worth understanding:
Vibe Hacking targets local AI instruction files like AI_CONFIG.md. Attackers subtly alter these to manipulate coding assistants into generating vulnerable code or taking actions the user never intended.
CursorJacking weaponises rogue extensions to silently siphon API keys, session tokens, and source code from local databases. Clean on the surface, leaking underneath.
CometJacking uses prompt injection hidden in malicious web pages to turn AI agents into unwitting data exfiltration tools. The attack doesn't target the human at all. It targets the AI acting on the human's behalf.
That last one is worth sitting with. The threat model has shifted. The AI isn't just a tool that can be misused. It's now a target in its own right.
What This Means for CISOs
The question facing security teams has changed. It's no longer whether employees are using AI (they are, extensively, and not always through approved channels). The actual questions are: where is AI running, which teams depend on it most, and is any of it visible to the people responsible for keeping the business secure?
The security teams that figure this out first will be in a far better position than those still writing acceptable use policies for tools their employees stopped waiting for permission to use months ago.