A conceptual graphic of a person using an AI chatbot on a laptop.

Mer_Studio // Shutterstock

Corporate America has been gung-ho about AI, but it hasn’t brought all employees up to speed on how to use it safely. The result is that many employees may be playing fast and loose with company data.

Nearly all (89%) workers have entered company data into AI. Sometimes that’s just a workplace address or phone number, but 79% have entered especially sensitive information, such as HR data, logins, and API keys, or customer/employee personally identifiable information (PII).

It’s ok for some workers to enter some of this information into some types of AI tools. But doing that comes with certain risks that leadership teams and employees should be aware of. Zapier surveyed 1,005 U.S. workers at companies with 500 or more employees to understand how business data is being handled in the age of AI.

Key findings:

  • 31% of workers say they enter login credentials or API keys into AI
  • 50% of workers have ignored their workplace’s AI restrictions
  • 36% of workers aren’t fully confident they know what’s ok to share with AI

31% of workers say they enter login credentials or API keys into AI

Most of us know not to keep work passwords on a sticky note on our desks. And yet, the vast majority of people have entered sensitive information into AI. While not all that information is confidential, 79% of workers have entered everything from customer or client names to login credentials, financial data, and Social Security numbers. Here were the most common culprits:

  • Employee info, like performance reviews or salaries: 37%
  • Customer or employee PII, like IDs and Social Security numbers: 36%
  • Customer/client names, email, and contacts: 36%
  • Login credentials and API keys: 31%

A data graphic revealing the top company information workers are entering into AI.

Zapier

The problem here is that this sensitive information is highly valuable to companies, customers, clients, and hackers. This is a known risk: hackers are using company-created AI agents to steal logins and other sensitive information.

Nearly three-quarters (72%) of respondents said they were worried about their organization experiencing a problem—like data exposure, compliance problems, or improper use of sensitive information—due to employees’ AI use. And those concerns are far from unfounded.

The point isn’t that sensitive data can never be used with AI. Many employees need it to do normal, legitimate work. The point is that data shouldn’t be poured into unsecured AI tools or accessed through AI under circumstances where access should be narrow, logged, and governed.

50% of workers have ignored their workplace’s AI restrictions

When companies provide AI licenses to staff, they should have clear governance policies explaining which tools to use, what’s allowed, and what happens when people decide the rules are more of a suggestion than a requirement. If there aren’t any consequences for ignoring company-provided accounts, some employees will predictably wander off into the wilderness of personal tools.

Around 1 in 4 (26%) workers say their organization restricts or blocks certain AI tools, but they’ve used a personal device or account to access the tools anyway. A similar percentage (24%) says they’ve tried to get around AI blockers with other workarounds, such as copying data into a personal tool or using a different browser.

A data graphic revealing that 50% of workers have ignored their workplace's AI restrictions.

Zapier

Not everyone using their own AI account for work is trying to perform a workplace heist. In many cases, they simply dislike the tools they were given. Among people using personal AI accounts for work:

  • 53% say they prefer their own tools’ interfaces or experiences
  • 39% say it’s too difficult or slow to get an employer-provided tool
  • 35% are infrequent AI users and don’t see the need for a work account
  • 33% say their employer’s AI tools don’t fit their needs

But around 2 in 5 (43%) of people using personal accounts say they want to keep their AI usage private from their employer.

36% of workers aren’t fully confident they know what’s ok to share with AI

The majority (85%) of employees say they usually consider whether information is safe before entering it into AI, which suggests most people aren’t blindly firing off Social Security numbers into ChatGPT. More likely, many simply don’t know what’s safe, what’s risky, and what their company would like them to stop doing immediately. Someone who doesn’t know what an API key even is probably won’t hesitate to drop it in an AI chat.

More than 1 in 3 (36%) workers aren’t fully confident they know what’s acceptable to share with AI at work, and—as we saw—even more are sharing sensitive information with AI tools that may not be safe.

The good news: training helps. The majority (82%) of people who feel fully confident about what’s ok to share with AI tools received formal training on AI use for work. That’s compared to only 46% of people who aren’t very sure—a pretty stark difference.

But training alone isn’t enough if people continue to share unsafe information or actively work around AI restrictions. Organizations need governance baked into their AI systems from the start, not smeared on later like decorative frosting over a structural crack. That means policies, approved tools, access controls, monitoring, guardrails, and workflows that make the safe path the easy path.

How companies can build strong AI governance

Creating new guidelines takes time and effort. But companies can start improving governance now with a few practical moves.

  • Don’t assume your staff completely understands AI governance and safety. Start with the basics when hiring new employees and building training procedures. Explain how your team uses AI, which tools are approved, and exactly what kinds of data can and cannot be used. (“Use your judgment” is not a policy.)
  • Learn how your staff uses AI and ask if they have the right tools to do their jobs. Audit AI usage where appropriate, or simply ask employees how they use AI day-to-day. What works? What slows them down? What are they solving with personal tools that the company should probably know about? The shadow workflow is often just an unmet need with a burner account.
  • Look for guardrails you can add to your existing workflow before building everything from scratch. There are likely checks and balances you can introduce into the tools employees already use. Find tools that can analyze text in real time and evaluate it for common security risks, including PII, prompt injections, or toxic content.

Humans are going to be human, so there’s no way to eliminate every possible security risk on your team. But you can make the secure path the easy path. When AI workflows are built on a governed infrastructure, employees don’t have to choose between the tool that works and the tool IT approved.

Methodology

The survey was conducted by Centiment for Zapier. The survey was fielded between May 13, 2026, and May 21, 2026. The results are based on 1,005 completed surveys. To qualify, respondents were screened to be U.S. workers at companies with 500 employees or more. All work at companies that have provided employees with paid plan access to AI tools or services for business tasks (including but not limited to ChatGPT Enterprise, Claude for Business, OpenAI/Anthropic/Google Cloud APIs, etc.). Data is unweighted, and the margin of error is approximately ±3% for the overall sample with a 97% confidence level.

This story was produced by Zapier and reviewed and distributed by Stacker.

About The Author
Lane Gillespie for Zapier