Pakistan’s National CERT has told organizations to rein in shadow AI, the unsanctioned use of public chatbots, coding assistants and AI browser extensions by staff, warning that passwords, code and confidential files could end up on platforms nobody vetted. The shadow AI advisory, reference NCA-18.011026, was reported by local outlets from October 3, 2026 and lays out a set of controls, from an acceptable use policy to logging who uses which AI tool.
In our view, none of it is exotic. The policy, approved-tool list and training controls are things a small firm can start on this month without buying anything.
| What happened | National CERT Pakistan published “Safe and Secure Use of Generative Artificial Intelligence (GenAI) Tools and Platforms” |
| Who’s affected | Any organization whose staff use public GenAI services, coding assistants, AI plugins or AI-enabled apps |
| Severity | Advisory (no single vulnerability); risks include data exposure, prompt injection and insecure AI-written code |
| Status | Guidance issued; AI-related incidents are to be reported to National CERT |
| What to do now | Write a short AI use policy, approve a tool list, ban sensitive data in unapproved tools, review AI-written code |
What the shadow AI advisory says
The advisory is aimed at the whole range of generative AI that staff now reach for, from free chatbots and code helpers to plugins and AI features inside other apps. Its main worry is shadow AI, which it says can leak business secrets, login details and code along with ordinary company data, PhoneWorld reported on October 3.
According to the shadow AI advisory, with corroborating coverage from PhoneWorld and ProPakistani, National CERT recommends:
- a compulsory acceptable use policy for GenAI, splitting uses into approved, restricted and banned;
- keeping personal, confidential and classified material, and anything credential-related, out of public or unvetted AI services;
- one central list of permitted AI tools, covering models, plugins, extensions and APIs, reviewed on a schedule, with access to unapproved AI services restricted;
- a competent person checking code written by AI, and other high-stakes AI output, before anyone ships or acts on it;
- DLP, endpoint protection and access monitoring that also watch AI interfaces;
- governance mapped to two reference documents: NIST’s AI Risk Management Framework and OWASP’s Top 10 for LLM Applications;
- periodic and role-based awareness training for employees, with prompt injection and deepfakes on the syllabus; and
- audit trails of authorized AI tool access and use.
The shadow AI advisory also tells organizations hit by an AI-related incident to contain access, preserve logs, revoke exposed credentials or API keys, and report to National CERT through its incident portal or by email.
How the attack works
Shadow AI rarely looks like an attack. An accountant pastes a client’s ledger into a free chatbot to tidy the formatting. A developer drops a config file, API key included, into a coding assistant to debug it. The data has now left your control, on terms you never agreed to, and you may not be able to get it deleted.
Prompt injection is the active threat. The OWASP Top 10 for LLM Applications ranks it first (LLM01:2025): instructions hidden in a web page, email or document are read by an AI tool as if they came from the user. An AI assistant with access to a mailbox or a browser can be steered into summarizing the wrong thing or sending data somewhere it shouldn’t. OWASP lists sensitive information disclosure second (LLM02:2025).
Browser extensions widen the exposure. An AI extension that can read every page a user opens can also read the CRM record, the bank portal and the HR system open in the next tab. The shadow AI advisory includes extensions and plugins in its approved-tools registry alongside the chatbots themselves, and we think that is the right call.
Why it matters for small businesses
In our experience, large companies can usually afford enterprise AI plans with data controls and a security team to watch them. A 20-person Pakistani software house, logistics firm or accountancy practice often has neither, and in our experience its staff use free AI tools anyway because they save real time.
In our experience, banning AI outright tends to push usage onto personal phones. We think the shadow AI advisory’s approach is more practical: decide what’s allowed, give staff a sanctioned option, and keep the riskiest data out.
Firms exporting services to clients in the EU, UK or US have a contractual angle too. Client data pasted into an unapproved AI tool can breach confidentiality clauses even where no Pakistani rule applies, so check your client contracts before staff do it for you.
What to do now
- Ask your team, without blame, which AI tools they use and for what. You can’t write a policy around tools you don’t know about.
- Write a one-page AI use policy: approved tools, what data never goes in (customer data, credentials, source code, contracts), and who approves new tools.
- Pick sanctioned tools with business data terms and give staff accounts, so the approved option is also the easy one.
- Review installed browser extensions on company machines and remove unapproved AI add-ons.
- Require a human review of AI-written code before it ships, the same as any other code.
- Keep credentials out of chat windows entirely. Store them in a team password manager; our comparison for small teams covers the options.
- Rotate any API key or password that has already been pasted into an AI tool.
For the wider threat picture, see 7 cyber threats every small business should plan for.
Oreaxe’s take
We think this is one of the more useful advisories National CERT has put out for the private sector, because it targets everyday behavior rather than a single bug. Its controls map closely to frameworks that international clients already expect, and NIST’s AI RMF is voluntary and downloadable from NIST.
Our priority for a small firm would be the data rule and the credential rule first. A policy document that nobody reads won’t stop a leak; a clear “never paste these four things” line, repeated in onboarding, often will.
We expect AI-related incident reporting to become a normal part of the conversation with National CERT. In our view, firms that can show a written policy and an approved tool list will have a much easier time explaining an incident than firms that discover their AI usage during one.
Sources
- National CERT Pakistan, advisory NCA-18.011026, “Safe and Secure Use of Generative Artificial Intelligence (GenAI) Tools and Platforms,” undated; reported October 3, 2026: pkcert.gov.pk
- PhoneWorld, “National CERT Issues Warning Over Cybersecurity Risks of Unauthorised AI Use,” October 3, 2026: phoneworld.com.pk
- ProPakistani, “National CERT Issues Warning Over Unsafe Use of AI Tools,” October 5, 2026: propakistani.pk
- TechJuice, “CERT Warns Pakistani Organizations Against Shadow AI Use,” October 2026: techjuice.pk
- OWASP, Top 10 for LLM Applications 2025: genai.owasp.org
- NIST, AI Risk Management Framework: nist.gov
Every factual claim links to its source. Spotted an error? Tell us.