Shadow AI Leaves Fingerprints: The Floppy Disk Lesson, Revisited

The decision this informs

This analysis is for the people who manage, publish or approve files and AI use: security and IT, communications, legal and AI governance leads. The decision is how to learn which AI tools are actually in use, and what leaves with the files they produce, without policing each prompt.

How much work runs through tools the organization does not manage

OpenAI’s paper “How People Use ChatGPT” (September 2025) covers only the consumer plans (Free, Plus and Pro), not the Business, Enterprise or Education plans. In the week ending June 26, 2024, those plans averaged 451 million messages a day, of which an estimated 213 million (47%) were likely work-related. In the week ending June 26, 2025, they averaged about 2.6 billion a day, of which an estimated 716 million (27%) were likely work-related. The work share fell, but on our arithmetic the estimated number of work messages rose about 3.4 times between the weeks ending June 26, 2024 and June 26, 2025 (our analysis). The paper does not say whether both totals include logged-out use, which its data hold only from March 2025, so the comparison may not be like for like. The totals are measured; the work counts are estimates from a classifier judging whether a random sample of conversations was “likely part of work”. NBER, which issued the paper as Working Paper 34255, states that its working papers have not been peer-reviewed.

A work message on a consumer plan is not, by itself, shadow AI, because a message does not show whether an employer provided the account, permitted it or knew about it. Surveys come closer, and each measures something different. In Microsoft and LinkedIn’s 2024 Work Trend Index, 78% of AI users said they bring their own AI tools to work, that is, tools their organization did not provide. Deloitte’s UK GenAI Workforce Survey 2026 reports that 31% of GenAI users use it for work without their employer knowing, on a weighted base of 13,798 employees who have used AI for work (fieldwork May-June 2026). PagerDuty’s 2026 Shadow AI Survey was run by Wakefield Research in April 2026 among 1,250 office professionals, excluding IT and technology roles, at companies with at least $500 million in annual revenue in Australia, Japan, the United Kingdom and the United States. It reports that 66% of those who have ever used AI for work have used AI tools at work that they believed company policy did not allow.

These are vendor-stated results from different questions put to different people, so they are not one rate and should not be averaged. They point the same way: sizeable shares of AI users report using tools, or using them in ways, their employer did not provide, know about or allow. PagerDuty also reports that 43% had entered work-related correspondence into public AI tools outside their company’s systems, 34% customer data and 31% financial information or confidential company documents or strategies, without stating the base for these figures.

The floppy disk, and where the comparison breaks

We use the floppy disk as a stand-in for any cheap, portable tool that lets people carry work and data across the organization’s boundary in ways IT did not plan for. A November 1983 Datapro report told corporate MIS departments that they had been able to ignore the two or three personal computers that had crept in, but could no longer ignore the influx of micros, and urged them to establish control. In August 1990, Virus Bulletin reported that a British bank, after a spate of virus attacks, had forbidden public domain software and placed external data transfers, including by tape or disk, under the control of its personal computing support team. These two sources show the effort to control, not whether it worked.

Our view is that when people reach for unsanctioned tools, the more useful reading is unmet needs, not disobedience; the sources here do not test that. What is new is that an AI-made file can record the tool it came from, as many in our library did. The comparison has a limit: a trace can be lost or never written, so a file is evidence of use, not proof of non-use.

What the files carry

These observations were made on October 19, 2026 with a local EmTrace engine running ExifTool 13.59, ffprobe 7.1.5 and c2patool 0.27.22. They show what such files can carry, not what any given file from these tools carries.

Signed Content Credentials were present on ChatGPT, Copilot and Gemini images, on Gemini video and music, on Suno audio and on some OpenArt videos. OpenAI says images generated with ChatGPT, Codex or its API include both Content Credentials and SynthID watermarks, while noting that coverage may vary by product, model, export path, file type and when the content was created. Anthropic says that when Claude generates a supported file type such as PNG or JPEG, it attaches a signed Content Credential.

The more revealing traces were not designed as marks. Anthropic’s API documentation says text files, PDFs and office documents that Claude produces in its code execution tool are not signed. Documents in our library from Claude’s apps and Claude Code carried other traces: a Word document named “Claude Docs” as its application, a workbook named openpyxl as its creator, and a Claude Code deck named PptxGenJS as its creator, last modifier and company and carried speaker notes. Copilot, Manus and Gamma documents carried the defaults of code libraries such as docx.js, python-pptx, PptxGenJS and pdf-lib. A library default suggests a file was produced by code; on its own it does not prove AI.

Some traces identify people, and they travel to whoever receives the file. Copilot- and Codex-made decks and a Copilot Word document carried a person’s name in their author or last-modified-by fields. Midjourney images held the prompt and its parameters in the PNG description and a user name in the author field.

The counter-argument: traces can be lost

The strongest objection is that traces are easy to lose, and the makers say how. OpenAI says its watermarks are designed to withstand common changes, but that heavy cropping, compression, substantial paraphrasing or translation can make one undetectable. It says Content Credentials can be lost through everyday actions such as taking a screenshot or converting a file, and Anthropic says a missing credential does not mean a file was not produced with Claude. Microsoft describes Content Credentials as signed metadata attached to a file and invisible watermarks as embedded in the content itself. A check that reads only file properties does not see a watermark. In our own library, tools that sign some outputs left others unsigned, and a Suno MP4 re-exported through CapCut carried no credential; whether it carried one before the re-export is not recorded.

So a file check cannot measure how much shadow AI an organization has, and it cannot clear a file that shows no trace. What it can do is show traces of the tools a file touched and the details it would pass to whoever receives it, without access to anyone’s accounts or chat history. It works beside access controls and approved tools, not in place of them, and checking employees’ files raises monitoring and notice questions to settle with counsel first; this analysis is not legal advice.

What to do next

In our view, the practices below are worth adopting, and files can inform each.

• Offer real alternatives. Approved tools can reduce shadow use when they match what people prefer; tools that keep appearing in your files may point to unmet needs.
• Train for data literacy, not just compliance. People who know what a file carries are likelier to make sound calls than people following a list of prohibitions.
• Trust, but verify. Set clear guidelines, then read what a document or image carries before it goes outside, and remove what should not travel.

We recommend starting with the files that leave the organization, reading any AI trace as information about which tools people use before assuming blame, and using what you find to decide which tools to approve, provide or retire.

EmTrace is a tool from Eminence Growth Solutions, which publishes this analysis.

Check a file with EmTrace. See the AI tools database and the platforms database.