On November 12, 2026, researchers Nolan Lovett of Old Dominion University and Mohan Yang of Texas A&M University published an empirical study examining why employees use unsanctioned generative artificial intelligence tools and conceal that use from employers. Released as an arXiv preprint titled ‘Beyond Curiosity: Habit and Organizational Learning Capability as Predictors of Shadow AI’ (arXiv:2611.16931v1), the multi-country analysis of 510 employed generative AI users challenges popular claims that workplace shadow AI stems from individual exploratory curiosity. Instead, the authors establish that ingrained habit and organizational learning capability dominate individual traits, providing actionable evidence for university IT governance, research security officers, and compliance administrators.
Challenging the Curiosity Myth in Unsanctioned AI Adoption
As generative AI tools spread across research and corporate workplaces, early commentary often assumed that unauthorized use was led by curious, tech-forward employees exploring new capabilities. Lovett and Yang tested this assumption against behavioral theories of habitual technology use and organizational learning capability (OLC). Analyzing a sample of 510 employed adult generative AI users across the United States (48%), United Kingdom (24%), Canada (9%), Mexico (7%), and other nations, the authors evaluated how individual dispositions and enterprise environments shape covert AI behaviors.
Across the sample, 22.2% of respondents reported using AI tools in ways not explicitly approved by their employers, 21.4% reported active strategies to conceal use, and 32.2% endorsed comfort taking risks with unsanctioned software. Crucially, unauthorized use and concealment were moderately correlated (r = .52) but functionally distinct. Disclosure was selective rather than absent: 69.4% disclosed AI use to their immediate team, while 13.7% told no one, and 8.4% presented AI-assisted work as entirely their own. In university labs where investigators uphold standards of research integrity, unvetted and concealed tool adoption introduces subtle risks of unverified outputs and provenance ambiguities.
Dominance Analysis and Relative Importance Weights
Through hierarchical regression, relative weights analysis with 5,000 bootstrap resamples, and full-subset dominance analysis across 512 possible predictor subsets, the authors compared workplace curiosity, habit, technology-acceptance beliefs, and organizational learning capability. Habit emerged as the single strongest predictor of shadow AI, accounting for 28.3% of explained variance (95% CI [15.8, 39.3]). In contrast, ‘joyous exploration’—the curiosity dimension most aligned with the adventurous employee narrative—contributed only 3.4% of explained variance (95% CI [1.6, 7.4]) and became statistically nonsignificant once habit and use frequency were included.
Dominance analysis showed that habit completely dominated joyous exploration across every one of the 512 model specifications. Furthermore, organizational learning capability subscales accounted for 24.1% of explained variance, led by an open experimentation climate (12.5%) and knowledge transfer (9.8%). The findings indicate that shadow AI is sustained by behavioral automaticity and organizational conditions rather than exploratory drive.
| Predictor Variable | Relative Weight (ε) | 95% Bootstrap CI | Share of Explained Variance | Role in Model |
|---|---|---|---|---|
| Habitual Automaticity | 0.070 | [0.038, 0.109] | 28.3% | Primary behavioral driver |
| Use Frequency / Behavior | 0.053 | [0.030, 0.084] | 21.7% | Secondary behavioral driver |
| OLC: Experimentation Climate | 0.031 | [0.013, 0.058] | 12.5% | Protective organizational context |
| Performance Expectancy | 0.029 | [0.015, 0.050] | 11.9% | Perceived task utility |
| OLC: Knowledge Transfer | 0.024 | [0.009, 0.048] | 9.8% | Protective organizational context |
| Social Influence | 0.016 | [0.007, 0.035] | 6.3% | Protective social support |
| Joyous Exploration (Curiosity) | 0.008 | [0.004, 0.020] | 3.4% | Distal individual disposition |
The Policy Paradox and Out-of-Pocket Provision Signals
The study also revealed key dynamics regarding organizational governance and employee spending. In decomposed regression models, formal policy presence without concurrent training was associated with higher concealment (B = 0.42, p = .046). Descriptively, policy-only environments exhibited the highest rates of unauthorized use (33.3%) and concealment (31.2%), whereas training-only environments showed the lowest rates (20.0% and 13.8%, respectively). Restrictive policies without educational support appear to drive established practices underground rather than curtailing them.
Personal financial investment surfaced as an additional diagnostic indicator of institutional access gaps. Approximately 16.9% of respondents paid out-of-pocket for AI tools used in their work, spending a median of $20 monthly. These personal subscribers displayed significantly higher unauthorized use (d = 0.43), concealment (d = 0.52), and risk comfort (d = 0.65). In academic research, where teams balance complex funder mandates such as NIH vs NSF vs ERC AI policies, self-funded subscriptions often indicate that institutional provisioning has failed to meet operational demands, exposing sensitive project data to unvetted commercial terms.
Governance Lessons for Research Offices and Lab Security
The findings offer practical guidance for higher education leaders, lab managers, and research compliance officers. Because habit overrides conscious intention once routines form, post-hoc restrictions cannot easily dislodge established workflows. Instead, institutions must deploy sanctioned, privacy-preserving AI platforms before enacting restrictive policies, satisfying workflow needs through approved environments.
Furthermore, institutions should avoid relying solely on punitive detection mechanisms. While technical reviews comparing AI detectors for research integrity offices highlight operational and reliability constraints, Lovett and Yang showed that perceived social support was protective specifically against concealment (B = -0.20, p = .010). Normalizing transparent discussion and embedding clear guidelines within an institutional research security policy enables organizations to address shadow AI effectively while maintaining data integrity across research activities.
Sources
- Nolan Lovett and Mohan Yang, ‘Beyond Curiosity: Habit and Organizational Learning Capability as Predictors of Shadow AI,’ arXiv preprint arXiv:2611.16931v1 (submitted 2026-11-12), https://arxiv.org/abs/2611.16931, checked 2026-11-15.
