The Shadow AI Tech Stack: 5 Tools Employees Are Using to Build Their Own Apps

What tools are employees using to build their own apps with shadow AI?

Shadow AI tools used by employees are no longer just chatbots pasted into a browser tab. They are full development environments: terminal-based coding agents, local test servers, tunneling tools, and no-code app builders that let non-engineers write, run, and deploy real software on their own. Nearly half of workers (49%) now use AI tools their employer hasn't approved, and 51% have connected AI tools to internal systems without telling IT.

This is not a fringe habit. It is a full technical stack, assembled one download at a time, sitting entirely outside the ticketing system.

Why does this look different from last year's shadow AI?

The first wave of shadow AI was simple: someone pasted a customer email into ChatGPT. The current wave is different because the barrier to actually building software has effectively disappeared. Gartner expects low-code and AI-assisted technologies to account for 75% of new application development by 2026, up from 40% in 2021. Stack Overflow's 2025 developer survey found 84% of developers now use or plan to use AI coding tools, up from 76% the year before, and those same assistants are just as available to a marketing coordinator as to an engineer.

Here are the five categories of tools showing up most often in that stack.

How are terminal-based coding agents (Claude Code, Codex) being used?

The biggest shift is employees running AI directly in a command-line terminal instead of a browser chat window. Tools like Claude Code let a non-technical person browse, edit, and execute files on their own machine, with the AI acting almost like a junior engineer who can see the whole project folder at once. Product manager and writer Teresa Torres, who is not a software engineer, documented building a full recreation of a competitive-research workflow this way: files, slash commands, and parallel research agents, all stored locally rather than inside a vendor's chat history. The appeal for a business user is real ownership of the output. The risk for a company is that none of it touches a code repository, a review process, or a security scan unless someone builds that in on purpose.

How do no-code and AI app builders (Replit Agent and similar) fit in?

Replit Agent and comparable tools turn a plain-language description into a running application, no coding background required. This is exactly what analysts mean by "citizen developer": an employee outside IT building a departmental tool, an approval tracker, or a reporting dashboard to solve their own problem. Gartner predicts that by 2026, developers outside formal IT will account for at least 80% of the people building applications with low-code tools. The trouble starts at the deploy step. Research scanning 5,600 AI-built production apps found more than 400 exposed secrets and 175 instances of exposed personal data, including medical records and bank details, sitting in live systems with no one watching them. A separate scan of AI-coded apps found zero out of 5,600 had CSRF protection, security headers, or properly scoped access policies.

Why are local tunneling tools (ngrok and similar) part of the stack?

Once someone has built something locally, the next question is how to show it to a colleague or connect it to a real webhook. Tunneling tools like ngrok solve that by exposing a laptop's local server to a public URL in seconds, no deployment pipeline required. Developers have used ngrok for years to test webhooks and share work in progress. The difference now is who is doing it. A person with no infrastructure background can point an AI-built prototype at a public internet address from their own desk, entirely outside any firewall rule IT set up on purpose.

Where do API testing and validation tools (Postman-style clients) come in?

Building an app usually means connecting it to something: a CRM, a spreadsheet API, an internal database. Employees who would never call themselves developers are now using API clients to construct and test those requests directly, often guided step by step by an AI assistant that writes the query for them. This is the quiet middle layer of shadow AI: not the flashy chatbot, not the finished app, but the plumbing that lets an unofficial tool actually talk to company data.

Why do free and personal-tier AI accounts get wired into work systems?

The most common building block is also the least visible one: a free or personal AI account, connected directly into a work process. Fifty-eight percent of employees using unapproved AI tools rely on free versions, and 34% of employees at companies that do allow AI tools still choose the free tier anyway. That matters because free tiers routinely train on submitted data, and workers are not shy about what they submit: 33% admit to sharing enterprise research or datasets, 27% to revealing employee data, and 23% to inputting company financial information. As BlackFog CEO Darren Williams put it, "there is always a cost to using free tools; in this case it's the value of your data."

What does it actually cost when it goes wrong?

The numbers below come from named studies, not estimates.

IBM's 2025 Cost of a Data Breach Report found the average shadow AI-related breach costs $4.63 million, about $670,000 more than a standard breach, and 63% of organizations hit by an AI-related breach had no AI governance policy in place at all. Separately, 20% of organizations reported having already experienced a breach linked to shadow AI, and 49% expected one within the next year.

None of this means the tools themselves are the problem. A terminal-based agent, a tunneling tool, and a free AI account are all legitimate pieces of a modern workflow. The problem is that they are being assembled with no inventory, no owner, and no review, which is a governance gap, not a technology one.

What can IT leaders actually do about it?

The fix is not a ban, since bans on categories of tool rarely survive contact with an employee who has already found a faster way to work. The more durable fix is visibility plus a sanctioned path:

• Inventory first. You cannot govern what you cannot see. Most major work platforms already have admin dashboards that show connected AI tools; most are underused.
• Give people a real path to production, not just a rulebook. If employees have a governed way to deploy the tools they build, they use it. If they don't, they build around IT anyway.
• Treat every AI-built app like an asset with an owner, a lifecycle, and an audit trail, the same way you'd treat any other piece of software the company depends on. That mindset, treating employee-built software as something the business owns rather than something that quietly rents space on someone's laptop, is the difference between shadow AI as a liability and shadow AI as a genuine source of leverage. Platforms built for exactly this handoff, like Remy, exist to give that self-built software a governed home instead of a forgotten one.