Netskope details four AI security blindspots controls miss
2 companies named across 5 categories, one of 299 articles referencing Netskope. Previous coverage: AI governance, networking and telecom updates - Week of October 12, 2026 (Oct 2026).
Best suited for
- Seniority
- C Level / Executive Team
- Job function
- Chief Information Security Officer
- Persona
- Security Operations Practitioner
- Buyer role
- Decision Maker / Budget Holder
- Decision stage
- How to start
- Adoption curve
- Early Adopters
- Technology maturity
- Market Correction
- Industry
- Information Technology / Cybersecurity / Exposure, Risk & Governance / Governance, Risk & Compliance (GRC) & Security Ratings
Our classification, not the publisher's statement. Best suited for, not only for.
Recent incidents from 2025 highlight how AI security gaps can bypass common controls, including network monitoring, chatbot-focused reviews, and data governance applied only to prompts and outputs.
Research Overview
The article summarizes four 2025 examples showing that AI risk can originate in areas security teams may not enumerate in their AI inventories or may not cover in security testing. It argues that many controls track network traffic patterns or user actions, while several failures occurred on endpoints, in the systems behind chatbots, within agent tool flows, or earlier in training data.
It also contrasts reactive AI governance with the need for visibility into endpoints, agent-related services, and the data pipelines that feed models and downstream use cases.
Key Findings
The article states that malware can use endpoint-resident AI tooling and exfiltrate secrets without generating detectable signals in network-based monitoring. It also says that securing a chatbot or model layer does not address weaknesses in the application services and data stores behind the chatbot.
In addition, it describes agent traffic and tool-access flows that may appear routine to network controls, as well as training-data quality issues that can surface before classification happens. The article concludes that data governance limited to prompt and response controls is insufficient when exports and upstream pipelines contain sensitive information.
Technical Breakdown
The first example describes attacker-published malicious versions of the Nx JavaScript build tool on npm, which searched for installed AI command-line tools and then prompted them with flags to look for secrets. The article says the malware leaked 2,349 distinct secrets, mostly GitHub tokens, by posting results to public repositories under victims’ accounts.
The second example focuses on a chatbot used in McDonald’s hiring workflow, where researchers found that an insecure API behind a staff login page allowed access to applicant records. The article reports that flaws exposed data tied to about 64 million job applications, and that Paradox.ai fixed both issues quickly after the researchers’ testing.
The third example describes a malicious MCP server delivered through an npm package, where an injected change added a line of code to BCC every outgoing message to an attacker-controlled address. The article says the package was downloaded 1,643 times before being pulled, and it argues that classification based on agent authorization is not enough to detect mistakes inside an authorized scope.
The fourth example describes training-data handling issues, including an audit finding that a face-blurring process missed an estimated 102 million faces across a large open-source dataset. The article also states that internal exports feeding downstream pipelines can create similar risk, and it argues that classification before export is needed.
Operational Impact
Operationally, the article says organizations may miss AI tooling that is not captured by procurement or app approval lists, especially when developers use endpoint tools or personal accounts. It argues that detection needs to include endpoint process lists, listening ports, and loopback traffic on managed devices to avoid inventorying only AI that is “seen.”
For chatbot and agent scenarios, the article says testing must extend through the full AI pipeline, including the databases and accounts with access, and it calls for session-level inspection and access policy checks for agent tool traffic. It further says that governance needs to address training-data and export pipelines, because sensitive information removal after training may require restarting the process.
This Blog Summary is a fact-based summary of the vendor blog.
Blog post, originally published by Kevin Cornejo at netskope.com.