AI Tool Spend Is the New Shadow IT — Here's How to Track It

A decade ago, "shadow IT" meant a marketing team quietly expensing a SaaS tool nobody in IT had approved. Today it looks like a five-person engineering team spinning up a dozen Cursor seats, an Anthropic API key shared across three projects, and a GitHub Copilot license for every new hire — all reasonable, all fast, and all invisible to whoever owns the cloud bill.

It's provisioned differently than cloud spend

Cloud resources at least tend to go through some kind of request path — a ticket, an approval, a Terraform PR. AI coding tools usually don't. A team lead swipes a card, adds five seats, and the tool is in use within the hour. That speed is a genuine advantage. It's also exactly why the spend sprawls faster than anyone notices: there's no natural checkpoint where someone asks "do we still need all of these?"

Three specific ways it gets wasted

The waste isn't hypothetical, and it isn't one thing:

• Idle seats. A Cursor or Copilot license assigned to someone who changed teams, went on leave, or simply stopped using the tool keeps billing every month until someone happens to audit the roster by hand.
• Unbounded API spend. An Anthropic API key with no usage visibility can go from "a few dollars a day" to a real line item with nobody noticing until the invoice — there's no equivalent of a VM sitting idle that you can visually spot; token spend is silent by default.
• No single owner. When AI tool billing sits outside the normal cloud-cost review, it doesn't get the scrutiny a comparably-sized cloud spend line would get as a matter of course.

What "tracking it properly" actually means

Treating AI tool spend seriously doesn't mean restricting access or slowing teams down — it means applying the same evidence-backed discipline already used for cloud infrastructure:

• Anthropic: Claude API token spend, usage trends over time, and rate-limit headroom, visible without logging into a separate billing console.
• Cursor: per-seat usage with explicit idle-license detection — not "how many seats are we paying for," but "which specific seats haven't been touched."
• GitHub Copilot: seat utilization and license spend, tracked the same way.

And critically: one roster, not three

The real unlock isn't monitoring each tool separately — that just adds three more dashboards to check. It's a single user-and-seat roster across all of them: who has access to what, who's active, who's been idle for weeks, and who should probably be revoked before the next renewal. One place to see "does this person still need this," instead of three logins and a spreadsheet.

The same pipeline, on purpose

This isn't a bolted-on side feature. It's the same evidence → recommend → approve → execute → audit pipeline that handles VM rightsizing and orphan cleanup, pointed at a different kind of resource. An idle Cursor seat and an idle VM are the same category of problem: spend that made sense to provision and stopped making sense to keep, discovered only if someone's actually looking.