AI Cybersecurity, Explained. Plain-language security for everyone, with practical steps for the organizations that answer for AI at work.
Between April and August 2025, about 12,000 people working for the Ontario government visited roughly 400 different AI websites on their work devices. Of those websites, 244, about 60%, were rated unsafe or unsecured by the government’s own security software (Office of the Auditor General of Ontario [OAGO], 2026, p. 12).
That finding comes from a 2026 special report by Ontario’s Auditor General on the province’s use of artificial intelligence. We examined its pages on AI medical scribes in an earlier post. But the report opens with something closer to everyday working life: what happens when staff reach for whatever AI tool is handy, and the organization cannot see what they put into it. Security people have a name for this. They call it shadow AI.
What the auditor found
The Ontario Public Service (OPS) uses Microsoft Defender, a security tool that discovers which AI websites staff visit and gives each one a score from zero to ten; a low score means a higher risk of data exposure. Websites scoring five or lower were treated as unsafe or unsecured. That was 244 of the roughly 400 sites. The auditor also noted that 15% of those low-scoring sites were not work-related and featured inappropriate content (OAGO, 2026, p. 12).
The deeper problem was not the list of websites. It was what the government could not see. The Ministry responsible could identify which sites staff visited, but it did not monitor what they did there, such as uploading files. And it had no controls to stop staff from inadvertently uploading Ontarians’ personal information, the auditor’s examples being health cards, driver’s licences and credit card information, or sensitive government material such as vendor contracts and invoices (OAGO, 2026, p. 12). When public AI websites receive that kind of data, the report notes, they may keep it and use it to train their systems.
The report gives one telling timeline. In early 2025, one AI website was reported to have privacy and security concerns. The federal government and British Columbia blocked it on their networks in February 2025. Ontario issued an advisory to staff that month, but did not block access until March (OAGO, 2026, p. 13).
Key idea: shadow AI
Shadow AI is any AI tool used for work that the organization has not approved, cannot see, or has not checked. It usually starts with good intentions: someone wants to summarize a report or draft a letter faster. It matters to ordinary people because the data pasted into those tools is often yours, from a health record to a benefits file, and once it leaves the organization, nobody inside can say where it went.
The approved tool got 6% of the traffic
Ontario did provide a safer option. Since October 2024, all OPS staff have had access to Microsoft Copilot Chat, the only generative AI website the government approved. When used correctly, it runs with an “Enterprise Data Protection” feature that keeps prompts inside the government’s secure environment and out of model training (OAGO, 2026, pp. 14, 16).
Staff largely used something else. From late April to mid-August 2025, other popular generative AI websites made up 94% of staff use, and Copilot Chat about 6% (OAGO, 2026, p. 14). The auditor added that even the approved tool could lose its protection: if staff opened it in Google Chrome or Mozilla Firefox without signing in with their government account, the data protection feature could be bypassed (OAGO, 2026, p. 16).
Training was available but optional. The government’s Responsible Use of AI course, launched in January 2024, had been completed by 1,800 of 55,000 staff, or 3%, by August 2025 (OAGO, 2026, p. 13). The auditor called the course comprehensive. Almost nobody had taken it.
The report’s own summary of the stakes is direct: “Even a single incident of one employee uploading personal or sensitive data” could lead to exposure, credential theft or a system outage (OAGO, 2026, p. 13).
Why blocking alone does not fix shadow AI
The auditor recommended that the government review and block unsafe AI websites and make sure all staff take AI risk training. The Ministry agreed, and told the auditor that since the audit ended it has blocked high-risk AI websites and is building a regular review process (OAGO, 2026, p. 33).
Blocking is necessary, but the 94-to-6 split tells a second story. People did not use unapproved tools because they wanted to leak data. They used them because those tools were what they reached for. Shadow AI is, at heart, an inventory and usability problem: an organization cannot govern tools it has not listed, and it cannot steer people towards a safe tool they do not find useful. The auditor’s other recommendations point the same way, asking the Ministry to set targets for use of the approved tool and report them monthly (OAGO, 2026, p. 15).
For any organization, the practical sequence is the same. Find out which AI tools are actually in use. Decide which are approved, and for what data. Make the approved option easy and good enough. Put technical controls on what can be uploaded where. Then train people, and check that they took the training.
What the record does not show
The audit describes risk, not a confirmed leak. It does not report that any specific Ontarian’s data was uploaded to an unsafe website, and because the government did not monitor uploads, that question could not be answered from its records. The report does not name the AI websites involved, including the one blocked in March 2025. The security scores come from a commercial tool’s rating, not from the auditor’s own testing of each site. And the Ministry’s statement that it has since blocked high-risk sites has not been audited; the auditor says it will follow up in a two-year follow-up report (OAGO, 2026, p. 33).
Questions you can ask
- If you deal with a public service or employer: Do staff use AI tools on my information, and which ones are approved for personal data?
- If you use AI at work: Which tool is approved for the data I handle, and what am I not allowed to paste into it?
- If you run an organization: Could we list today every AI website or tool our staff used last month, and show what data they were allowed to put into each?
- If you provide an approved tool: What share of AI use does it actually get, and why do people choose something else?
Go further. Operational AI Readiness is FairByDesign’s free field manual for AI that is already live. Chapter 2, Where Risk Appears in Live AI Systems, shows why unlisted tools are where risk hides, and Chapter 7 covers security controls for AI tools and workflows. The free readiness assessment starts with inventory and scope for the same reason. Read the book free.
Support independent reporting on AI. We read the full 50-page audit so you did not have to, and we stay independent of the governments and vendors we write about. That only works because readers fund it. If this helped, please give once ($5, $10, $25, $50 or any amount), give monthly ($10 or $25), or become a patron: fairbydesign.org/patrons-2. Support never buys editorial control.
References
Bakos, V. (2026). Operational AI readiness: A practitioner guide to governing AI that is already live. FairByDesign. https://fairbydesign.org/operational-ai-readiness/
Office of the Auditor General of Ontario. (2026). Use of artificial intelligence in the Ontario government [Special report]. https://www.auditor.on.ca/en/content/specialreports/specialreports/en26/2026_AI_EN.pdf
Leave a Reply
You must be logged in to post a comment.