A bank’s SEC filing over unauthorized AI use shows how shadow AI can turn an employee shortcut into a material cyber event.