TL;DR: Legacy DLP was built for predictable human data movement, while AI assistants and MCP-connected agents now move sensitive data across browsers, endpoints, SaaS, and workflows at machine speed, according to Nightfall’s State of Agentic Data Security 2026 report. The practical implication is that identity-aware, inline control is becoming more important than pattern matching alone, especially where agent permissions and secrets exposure create new exfiltration paths.
At a glance
What this is: Nightfall argues that AI-era DLP has moved beyond static detection toward real-time enforcement across SaaS, browsers, endpoints and MCP-connected agent workflows.
Why it matters: This matters because IAM, PAM and NHI teams now have to govern how identities, agents and secrets move data at runtime, not just how files are classified after the fact.
By the numbers:
- Nightfall reports approximately 95% detection precision out of the box, compared with the 5-25% baseline it attributes to legacy DLP built on keyword and regular-expression matching.
- Nightfall says its AI-powered detection platform can reduce false positives by as much as 99%.
- Nightfall says a first SaaS application or endpoint can be set up in approximately 10 minutes, with supported SaaS coverage live within the hour and endpoint agents distributed through MDM in roughly 30 minutes.
Context
Data loss prevention has shifted because data no longer moves only through predictable human channels. AI assistants, browser copilots and MCP-connected agents can read, transform and send sensitive material across SaaS, endpoints and workflows in ways that legacy rule-based controls were never built to govern.
The identity problem is now part of the DLP problem. When a service account, agent or assistant has the ability to access data and act on it in real time, the control point has to move closer to authorization, runtime context and inline enforcement rather than relying on post-event detection alone.
This article is best read as a control-model comparison, not a product review. The real question is whether organisations can still depend on pattern matching and delayed review when machine-speed workflows create exfiltration paths that look operational until they become a breach.
Key questions
Q: Where does legacy DLP fail when AI agents move sensitive data?
A: Legacy DLP fails when it assumes a person will move data in a slow, visible way. AI agents can read, transform and forward sensitive information across multiple systems inside one workflow, which makes after-the-fact review too late. The failure is not only in detection quality, but in the control model itself.
Q: Why do AI assistants increase post-breach exfiltration risk?
A: They can compress the time it takes to find and collect sensitive material once an attacker has a foothold. Instead of moving manually through mail, files, and calendars, the attacker can use the assistant’s trusted context to navigate business data quickly. That increases blast radius even if the original compromise was ordinary.
Q: What do security teams get wrong about DLP and AI assistants?
A: They assume DLP will catch unsafe sharing even when the assistant is acting inside a trusted workflow. In practice, the failure is often contextual: the wrong record is summarised, the wrong recipient is served, or policy labels are ignored without a classic exfiltration event. Behaviour monitoring is the missing layer.
Q: Should organisations treat AI agents as NHI or as application automation?
A: They should treat them as governed non-human identities with application behaviour. That framing captures the need for identity, scope, lifecycle, and audit controls while still recognising that agents operate through APIs, tools, and workflows. Pure automation language hides the governance gap.
Technical breakdown
Why legacy DLP struggles with AI-driven data movement
Legacy DLP was designed around predictable human actions such as emailing a file or copying text into a document. It usually depends on regular expressions, keyword matching and classification rules that work reasonably well when data moves slowly and in known formats. AI assistants and agents break that model because they can transform content, route it through tools, and send it across multiple systems in a single task. The security issue is not only the content itself, but the actor, the channel and the timing. When the workflow is dynamic, pattern-only controls generate noise or miss the actual exfiltration path.
Practical implication: Treat DLP as a runtime governance problem for identities and agents, not a post hoc content-scanning problem.
How inline control changes the enforcement model for SaaS and agents
Inline control means the policy acts at the moment the data is about to move, rather than after a violation is detected. That can include blocking, redaction, quarantine, encryption, deletion or access revocation, applied through SaaS APIs, browser controls, endpoint agents or agent gateways. For MCP-connected workflows, the important distinction is whether the platform can observe and stop tool calls at the point where the agent is about to read, transform or transmit sensitive data. If the control only sees logs after execution, it is not controlling agentic movement in any meaningful sense.
Practical implication: Prioritise enforcement paths that can block or rewrite the transaction before the agent completes the data transfer.
Why MCP and agentic workflows change the DLP boundary
MCP gives AI systems a standard way to connect to tools and data sources, which makes governance easier in one sense and harder in another. The standardization is useful, but it also creates a common pathway for sensitive data to be read and forwarded by assistants, IDE agents and remote services. Local stdio connections are especially important because network-only monitoring may not see the full exchange, even though the tool actions still create business risk. That means DLP, identity, endpoint and gateway controls need shared visibility into permissions, approved tools and the runtime boundary of the agent.
Practical implication: Map where MCP traffic is observable and where it is not, then close the blind spots with endpoint or gateway enforcement.
Threat narrative
Attacker objective: The attacker’s objective is to extract sensitive data through trusted AI-enabled workflows while avoiding the friction that traditional DLP expects from human users.
- Entry occurs when an AI assistant, browser plugin or MCP-connected agent is granted access to sensitive content or tools as part of normal work.
- Credential or permission abuse follows when the workflow can read, transform or transmit data beyond the original human intent, especially if secrets or broad tokens are available.
- Exfiltration happens when the agent moves sensitive information across SaaS, web, email or endpoint channels faster than manual review can intervene.
Breaches seen in the wild
- DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
- Microsoft verified publisher OAuth phishing 2022: Malicious OAuth apps with a fraudulently obtained Microsoft verified publisher badge tricked UK users into granting mailbox access in 2022.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI-era DLP has become an identity and runtime enforcement problem, not a content-classification problem. Static detection was built for human-driven movement and predictable file handling. Once agents, copilots and MCP workflows can act across multiple systems in one session, the decisive control is whether the platform can govern the actor and the transaction, not just the text pattern. Practitioners should stop treating DLP as a scan-and-alert layer and start treating it as an access-control layer for data movement.
Inline control is the right architectural response to machine-speed exfiltration. The article’s core distinction is not about better alerts, but about acting before a transfer completes. That shift matters because review-based workflows assume there is time to investigate, while agentic systems may complete the risky action before a human analyst can intervene. For identity programmes, this means runtime policy and permission scope become part of the same control plane.
AI agent data leakage creates a verification gap. Organisations may know which model or assistant they approved, but not whether the workflow will move data into a transport the security stack can actually see. That gap is amplified when MCP servers, browser extensions and endpoint agents all participate in the same task. The practitioner conclusion is straightforward: govern the path, the token and the tool set together, or the policy boundary will remain theoretical.
Detection precision matters, but only when it is paired with enforceable response. High-confidence classification still fails if the platform cannot block, redact, quarantine or revoke access at the moment of risk. The market is moving toward controls that combine classification with action, and that is especially relevant where AI tools blur the line between sanctioned productivity and data exfiltration. Teams should evaluate whether their DLP stack can change outcomes, not just produce better alerts.
MCP security is becoming part of NHI governance whether teams label it that way or not. Once an agent can invoke tools and move data through delegated access, the workflow behaves like a non-human identity with real operational authority. That means inventory, authorization scope, revocation and runtime observability all matter in the same way they do for other machine identities. Practitioners should align DLP, NHI and AI governance around the same access lifecycle, not separate them into different teams.
From our research library:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
AI agent data movement is now a governance boundary, not just a detection problem. Security teams that still rely on alerts to catch disclosure after the fact will keep missing the moment when an assistant or agent actually moves the data. The more machine-driven the workflow becomes, the more the control point must shift to authorization and runtime enforcement.
Agentic workflows create a verification trust gap. Teams may approve the tool or model but still lack visibility into the exact path a prompt, file or token takes across SaaS, browser and MCP layers. That is why DLP, IAM and NHI governance need to converge on the same access decision rather than operate as separate review processes.
MCP-aware enforcement is emerging as the practical control plane for AI-era leakage. Once local stdio, remote HTTP and IDE-embedded agents are all in scope, the question becomes whether policy can travel with the workflow. The organisations that can see and stop movement at runtime will have a materially smaller exfiltration window than those that rely on scanning alone.
For practitioners
- Map AI data movement to runtime controls Identify which SaaS apps, browsers, endpoints and MCP workflows can move sensitive data today, then decide where blocking, redaction or revocation must happen before transfer completes.
- Inventory MCP-connected tools and assistants Document every local stdio, remote HTTP and IDE-embedded agent that can reach sensitive systems, including the permissions and credentials each workflow uses.
- Separate detection from enforcement requirements Test whether your current DLP stack can only alert after content is exposed or can actually stop, quarantine or redact the transfer inline.
- Review NHI and agent permissions together Treat AI assistants, service accounts and automation tokens as one governed access surface, then narrow any scope that lets them read and forward sensitive data without a runtime check.
Key takeaways
- Legacy DLP is increasingly mismatched to AI assistants and MCP-connected agents because those actors can move sensitive data across systems at machine speed.
- The practical control shift is from pattern matching toward inline enforcement that can block, redact, quarantine or revoke access before disclosure completes.
- For identity and security teams, the key design question is whether permissions, secrets and runtime policy are governed together across agents, endpoints and SaaS.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article links AI-era data movement to exposed secrets and credentials in agent workflows. |
| NHI-05 — Overprivileged NHI | Agentic DLP fails when assistants and MCP workflows have more access than the task requires. | |
| NHI-10 — Human Use of NHI | The article describes humans delegating data-moving authority to assistants and agents through shared workflows. | |
| Recommendation — Scan agent workflows for secret leakage and block transfers that expose credentials or tokens. Reduce agent and service access scope so DLP can enforce task-scoped permissions. Separate human approval from machine execution and govern delegated data movement explicitly. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Inline DLP depends on controlling which identities and agents can move sensitive data. |
| Recommendation — Review entitlements so only approved identities can trigger sensitive data movement. | ||
| MITRE ATT&CK | TA0006; TA0010 — Credential Access; Exfiltration | The article centers on credentials, permissions and the exfiltration path through AI workflows. |
| Recommendation — Map AI data-loss scenarios to credential access and exfiltration techniques to improve detections. | ||
| NIST AI RMF | MANAGE — AI risk management and mitigation | The topic is the operational management of AI-driven data movement risk. |
| Recommendation — Manage AI data movement risk with runtime controls, governance and response ownership. | ||
Key terms
- Inline DLP: Data Loss Prevention that acts while content is being shared, rather than after the fact. Inline DLP can redact, block, quarantine, or alert on sensitive data in messages and files, making it a control for active exposure reduction instead of retrospective reporting.
- MCP Workflow: An MCP workflow is the sequence of steps an AI agent follows when using the Model Context Protocol to request tools, data, or actions. It defines how the agent discovers capabilities, sends structured requests, receives responses, and continues execution. In security terms, it creates a governed path for agent-to-system interaction.
- Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
- AI-Era Data Movement: AI-era data movement is the flow of sensitive information through copilots, assistants, agents and connected tools rather than through manual user actions alone. It changes the security problem from classifying files to governing how an automated actor can access, transform and transmit data.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and machine identity security. It helps security practitioners connect access control, lifecycle governance and runtime risk across modern identity programmes.
Published by the NHIMG editorial team on August 18, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org