Artificial intelligence is becoming part of daily software delivery, often before it becomes part of the security architecture. That gap has a name: Shadow AI . It is any AI tool, model, agent, extension, or integration used in the software lifecycle without formal approval, ownership, risk assessment, or monitoring. For platform and security teams, Shadow AI is not really a “developers using a chatbot” problem. Ungoverned AI can reach source code, secrets, customer data, cloud environments, and deployment workflows.
And once an AI system is allowed to call tools and take actions , it stops being productivity software and becomes a new non-human identity with permissions, a blast radius, and a place in your threat model. This article threat-models a common cloud-native delivery path, from a developer laptop to a workload running in a Kubernetes pod, and maps each stage to controls you can implement today with CNCF and open source projects. The risk rises sharply when AI stops giving advice and starts taking action .
An assistant that suggests a code snippet creates one class of risk: data leaving an approved boundary, or a subtly wrong suggestion trusted without review. An agent with a Git token, cloud credentials, or a Kubernetes ServiceAccount creates a different class entirely. It can create, alter, or delete resources at machine speed, and Kubernetes will not distinguish between a harmful action taken by an attacker and the same action taken by an over-privileged automation identity.
So the questions worth answering are operational, not philosophical: A workable model gives every agent a human owner, registers it as an identifiable workload, constrains it with least privilege, and monitors what it actually does. Delivery path from developer laptop to Kubernetes pod, showing Shadow AI injection points at each stage and the defensive control that clamps each one Shadow AI can appear at every stage, and a small convenience decision at the start of the path can become a production exposure at the end. A threat model does not require you to predict every attack.