Behavioural Drift
Medium
Work Shifted to Personal Stack
Across four workdays, moved daily project activity from Slack and Google Drive into a personal Gmail account and private Notion workspace.
+2
Shadow AI
Low
Internal Notes Used in Personal AI
Copied internal meeting notes from Google Docs, pasted them into a personal AI chat, and requested a summary with suggested next steps.
+2
Access Abuse
Critical
OAuth App Granted Broad Access
Created a new OAuth application in the admin console and granted it read access to Gmail, Drive, and shared calendars across the organization.
Shadow AI
Medium
Customer Records Pasted Into ChatGPT
Copied a table of customer records from Salesforce, opened ChatGPT in a personal browser profile, pasted the records, and requested outreach recommendations.
+2
AI agents delegation
Low
Assistant Connected to Work Accounts
Installed an AI meeting assistant, connected the corporate Google account, and granted access to Gmail, Calendar, and Drive.
+2
Shadow AI
Medium
Board Screenshot Used for Enrichment
Opened a confidential board document in Google Drive, captured the visible page, pasted the screenshot into Claude Desktop, and requested an enrichment report.
+2
Behavioural Drift
High
Engineer Explored Unrelated Repositories
During three consecutive sessions, moved from the assigned repository into unrelated services, searched for credentials, and saved selected findings into local notes.
+2
Data Exfiltration
High
Customer Pipeline Sent to Gmail
Exported the full opportunity pipeline from Salesforce, attached the spreadsheet to a Gmail message, and sent it to a personal address.
+2
