The Paste Problem: What Your People Actually Put Into AI

No one in that story meant any harm, and no one broke a rule they knew about. The numbers say it's an ordinary Tuesday, not an edge case.

So what happened to that document?

Personal AI accounts are mostly used for work. Harmonic Security, which monitors AI use inside companies, classified 1.9 million minutes of AI sessions across six tools in early 2026 and found that 64.5% of activity on personal-plan accounts was business use. The typical session wasn't a private errand. It was a work email, tidied meeting notes or a bug fix.

The split varies by plan. Business use made up 80.2% of Copilot Free activity, 67.2% of Claude Free, 60.6% of ChatGPT Free and 40.5% of Gemini Free. Paid personal plans look the same: 75.5% for Claude Pro and 71.2% for ChatGPT Plus.

Sensitive material goes along for the ride. Cyberhaven's 2026 analysis of 222 companies found that 39.7% of AI interactions involved sensitive data, counting prompts, copy-paste actions and file uploads. The average employee puts sensitive data into an AI tool about once every three days. A big share of that runs through accounts the company can't see:

Harmonic's 2025 data shows what that costs in exposure terms. Across 22.5 million prompts and uploads to 665 tools, 16.9% of sensitive exposures (98,034 of 579,113) came through personal free-tier accounts. That figure covers the five providers where Harmonic could see the plan type.

None of this is new. Microsoft and LinkedIn reported in May 2024 that 78% of AI users were already bringing their own AI tools to work.

Treat these as direction, not a census. Every figure except Microsoft's comes from a security vendor measuring companies that pay for monitoring. The samples differ and the measures aren't interchangeable, since a share of exposures and a share of usage describe different things. What they agree on is the shape: sensitive material flows into AI tools every few days, and a large share of it moves through accounts the employer doesn't control.

Which account Alice was signed into matters more than which company's model answered. The same paste meets very different terms depending on the plan.

We checked both against each company's own pages in October 2026. These terms have changed before and will change again, so check them on the day you rely on them. We haven't checked Google Gemini or Microsoft Copilot.

Two details matter more than the headline. First, switching training off later doesn't pull your data back out. Anthropic says chats already contributed stay in training that has begun and in models already trained. Second, personal accounts sit outside the controls a company counts on. The security vendors Cyberhaven and Harmonic both report that personal accounts bypass single sign-on and central logging, and Harmonic adds that there's no audit trail for IT to consult.

Australia's privacy regulator is blunter than most vendors. The OAIC's guidance of 21 October 2024 says that, as a matter of best practice, organisations shouldn't enter personal information, and particularly sensitive information, into publicly available generative AI tools.

Bans and scanners are both aimed at the tool, and the tool isn't where the decision gets made.

Take bans first. Cyberhaven argues that broad attempts to block AI rarely reduce risk, because use moves out of sight. Harmonic makes the same case: block ChatGPT Free and people try Claude, Gemini or Perplexity instead. Both companies sell monitoring, so weigh the opinion accordingly. But it matches what Alice did when her approved tool timed out. We covered the wider argument in The Shadow AI Problem.

Scanners struggle for a related reason. Cyberhaven puts the exposure down to fast adoption running into slow security programs and older controls. A pasted paragraph carries no file name and no classification label, so there's little for a tool built around files to catch.

The subtler problem is the shortcut most leaders reach for: personal accounts are risky, work accounts are safe. Harmonic's 2026 data breaks it in both directions. Most activity on personal accounts (64.5%) is business use. And of the minutes people spent on genuinely personal tasks, 45.6% happened on enterprise-licensed plans. A rule keyed to the account or plan will flag the wrong things and miss the right ones.

That's why the test later in this report starts with the data, not the tool.

Three things are exposed when the wrong material reaches the wrong account, and each deserves a hedge rather than a scare.

For scale, IBM's 2026 study puts the global average breach cost at $4.99M, up 12%. That covers all breaches, not only AI-related ones, but it sets the order of magnitude when information leaves your control.

Before anything goes into an AI tool, ask three questions. They take about five seconds and don't require understanding how the tool works.

Run it on Alice's paste. The supplier note is someone else's commercial information, it could move a deal, and she was on a personal account.

That's three flags, and the right answer was the approved tool, or the same request with the supplier note taken out. Either would have cost her a few minutes, which is exactly the problem.

The test doesn't make a personal account safe. It makes the decision visible, and a visible decision is one a person can get right.

If the safe route is slower than the unsafe one, the unsafe one wins. Five moves follow from that.

1. 01

   Provide a sanctioned tool that's at least as good as the personal one, and tell people it exists. Business and enterprise plans from OpenAI and Anthropic don't train on your data by default (see the table above). Harmonic reports that employees reach for personal accounts when the company tool is missing, has tighter limits or slower performance, or when nobody told them it was available.

2. 02

   Make it the default. People use what's already open and signed in, often a personal account on a personal device. Put the approved tool where the personal one used to be: the bookmark, the browser profile, the first thing on the desktop.

3. 03

   Write down what's off-limits in plain words, no longer than a page. Build it from the three questions and give three real examples from your own business, such as a client list, a pricing model or a salary review.

4. 04

   Warn and redirect rather than block. Harmonic's suggestion is a banner that points people to the approved tool when they're on a personal account. It keeps your visibility, and it reaches the person at the moment of the decision.

5. 05

   Teach judgment, not prompting. Ten minutes working through your own documents with the three questions is a better start than a course on prompt tricks.

Every figure in this report was read on the publisher's own page in October 2026. Where a number reached us only through second-hand coverage, we left it out. That includes IBM's headline 2026 shadow AI figure: it's widely reported, but we couldn't confirm what it counts (organisations, breaches or incidents), so it isn't here. Legal commentary is credited to the firm that wrote it, and we haven't read the court decisions it describes.

Most of the behaviour data comes from security vendors, and provider terms change often. Check them on the day you rely on them. This report isn't legal advice.