AI-based data exfiltration is outpacing legacy DLP controls

At a glance

What this is: Cyberhaven argues that AI tools, browser sessions, cloud sync, email, and removable media now drive most practical exfiltration paths, while legacy DLP struggles to see transformed or pasted data.

Why it matters: For IAM, NHI, and security teams, the key issue is that data loss now often happens through governed identities and legitimate sessions, so controls must shift from file inspection to context and lineage.

By the numbers:

• 39.7% of all AI interactions involve sensitive data, according to Cyberhaven research cited by Cyberhaven.
• Approximately 44% of AI use occurs through personal accounts where enterprise visibility is absent, according to Cyberhaven research cited by Cyberhaven.

Context

Data exfiltration is the unauthorized transfer of sensitive information out of organizational control, and the main governance gap is no longer simply outbound email or USB theft. Modern work moves data through AI tools, browser sessions, personal cloud accounts, and shared SaaS workflows, which means content controls built for files and attachments miss the way work now happens.

That shift matters to IAM and NHI programmes because legitimate identities, sessions, and delegated access are now part of the exfiltration path. When users paste data into AI tools, sync files to personal accounts, or move information through webmail, the control problem is not just the channel but the identity context, the session boundary, and the lack of data lineage across downstream copies.

Key questions

Q: What fails in traditional DLP when employees use AI tools with enterprise data?

A: Traditional DLP fails when data is no longer moving only through files, email, and endpoints. AI turns prompts, responses, plugins, and agent actions into new transfer paths, so controls built for static objects miss how data is interpreted and recombined. The practical failure is visibility first, then enforcement.

Q: Why do personal AI accounts and browser sessions increase exfiltration risk?

A: They increase risk because the enterprise loses visibility into both the session and the destination. The user may be authenticated to a legitimate service, but the data can still cross into unmanaged storage, chat history, or downstream sharing. That makes identity trust insufficient on its own. Governance has to cover where the data goes after the session ends.

Q: What are the signs that browser-based exfiltration is happening?

A: Common indicators include unusual webmail forwarding, external form submissions, spikes in cloud sync activity, repeated uploads to unsanctioned SaaS tools, and copy-paste behaviour that does not match a user’s normal role. The clearest signal is a change in data movement patterns, especially when it clusters around departure windows or workarounds to policy restrictions.

Q: How should security teams govern data lineage for AI systems?

A: Security teams should govern data lineage by tracing every AI input class to an owner, a source system and a freshness rule. Training data, RAG sources, embeddings, prompts and agent inputs need different controls because they shape behaviour in different ways. The goal is to prove provenance, not just collect logs.

Technical breakdown

Why legacy DLP misses AI-based exfiltration

Legacy DLP was designed around known content patterns moving through predictable channels such as outbound email or file transfer. AI-based exfiltration breaks that model because data can be pasted into prompts, summarized inside a model, and returned in transformed form that no longer matches the original file or keyword signature. Once the sensitive content leaves as prompt text rather than as a document, inspection-only tools lose the thread. The problem gets worse when employees use third-party AI platforms or personal accounts, because the organization may never see the transaction in the first place.

Practical implication: shift from file-pattern inspection to controls that understand prompts, sessions, and data lineage.

Browser and SaaS leakage as an ungoverned data egress path

Most modern work happens in the browser, which makes SaaS applications and web forms de facto export channels. Copying content into external forms, uploading to unsanctioned services, taking screenshots, or using browser extensions can move sensitive data without traditional network or email controls ever seeing a file transfer. Because these actions occur inside ordinary web sessions, they are difficult to distinguish from legitimate productivity unless the endpoint or browser layer captures context. This is where browser activity becomes a governance problem, not just an endpoint problem.

Practical implication: monitor browser-mediated data movement with controls that can distinguish sanctioned work from unsanctioned egress.

Data lineage is the missing control plane for exfiltration

Data lineage tracks a piece of information from origin through copies, transformations, and destinations. That matters because modern exfiltration rarely preserves the original file boundary. A document may be pasted into chat, reformatted, synced, and forwarded before it exits the enterprise, leaving content-only controls unable to reconstruct what happened. Lineage gives security teams a way to ask where the data came from, how it changed, and which identities or sessions handled it. Without that chain, detection stays reactive and narrow.

Practical implication: build exfiltration detection around lineage so policy follows the data, not just the file.

Threat narrative

Attacker objective: The objective is to move sensitive organizational data outside control while blending the activity into legitimate work patterns and evading content-only detection.

1. Entry occurs when a user moves sensitive data into an AI tool, personal cloud account, webmail session, or browser-based SaaS workflow as part of ordinary work.
2. Credential or session trust is then exploited because the action uses legitimate identities and authorized access, making the transfer look like normal user behaviour.
3. Exfiltration completes when the information is transformed, copied, or forwarded outside organizational control through prompts, uploads, browser forms, or sync destinations.
4. Impact is loss of confidentiality and loss of visibility, because legacy DLP cannot reliably reconstruct the downstream movement of the sensitive data.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI-based exfiltration is a data governance problem that legacy DLP was never built to solve. The core failure is not simply that users share data, but that they do so through prompts, browser sessions, and transformed outputs that break file-centric inspection. That means confidentiality controls now have to follow data through identity and session context, not just through content signatures. Practitioners should treat this as a control-plane shift, not a tuning exercise.

Browser-mediated leakage creates an identity-bound exfiltration path that many programmes still understate. Once employees move information through webmail, SaaS forms, extensions, or personal accounts, the enterprise loses both channel visibility and downstream ownership. This is where IAM and NHI governance intersect with data security: the identity used to access the tool is legitimate, but the destination and reuse of the data are not governed. Security teams need policy enforcement at the point of transfer, not after data has already crossed the boundary.

Data lineage is becoming the decisive named concept in exfiltration prevention. Content inspection asks what the file looked like; lineage asks where the data came from, how it changed, and where it went. That distinction matters because modern exfiltration increasingly involves copy, paste, summary, and re-entry rather than simple attachment transfer. Organisations that cannot trace downstream movement will keep mistaking normal work for safe work. Practitioners should make lineage the basis for exfiltration analytics and response.

Shadow AI and personal-account AI use expand the governance gap faster than policy reviews can close it. Cyberhaven's figures point to a control problem that is already embedded in daily work, not an edge case. When nearly half of AI use happens through personal accounts, the enterprise cannot rely on awareness campaigns alone. The practical conclusion is to combine discovery, contextual blocking, and user-level exception handling so sanctioned AI use remains usable while unsanctioned paths are constrained.

Insider-risk programmes now need to separate intent from mechanism. The same exfiltration channel can represent malicious theft, convenience-driven leakage, or policy workarounds, but the control requirement is often the same: detect sensitive data leaving the environment before the transfer completes. That makes behavioral analytics, user baselines, and transfer-time enforcement more valuable than post-event alerts. Teams should design response around movement patterns, not only around user suspicion.

From our research library:

• 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
• Read next: Red Teaming AI Agents for Identity Abuse

What this signals

Data lineage is becoming the practical control boundary for modern exfiltration programmes. Security teams that still rely on channel-by-channel DLP will miss the fact that AI prompts, browser uploads, and personal cloud sync are all part of the same movement path. The programme question is no longer whether data was copied, but whether the organisation can trace and govern every downstream copy.

AI-based exfiltration requires identity-aware enforcement, not just content-aware inspection. When 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, the concern is not theoretical. It signals that governance must extend to who can submit data, from which session, and into which AI service boundary.

Browser activity has become a security control surface in its own right. Teams that do not instrument browser-mediated transfers will keep treating ordinary work as low-risk even when it carries regulated, proprietary, or operationally sensitive information. The next step is to align endpoint telemetry, identity context, and data lineage so the policy decision happens before the transfer closes.

For practitioners

• Deploy transfer-time controls for AI and browser sessions Intercept copy, paste, upload, and submission actions in browser-mediated workflows so sensitive data can be governed before it reaches third-party AI tools or unsanctioned SaaS destinations.
• Map and monitor data lineage for high-value information Track sensitive data from source systems through downstream copies, summaries, and reformats so security teams can see where information actually leaves control.
• Separate sanctioned AI use from personal-account use Identify where employees are using public or personal AI accounts and apply policy controls that differentiate approved enterprise sessions from unmanaged ones.
• Baseline browser and sync behavior by user role Flag unusual cloud sync spikes, webmail forwarding, and external form submissions against each user’s normal work pattern, especially around departure windows or role changes.
• Treat browser extensions and SaaS forms as exfiltration surfaces Review extension permissions, clipboard access, and external form submission paths because these channels can move sensitive data without file-based alerts.

Key takeaways

• AI tools and browser-based workflows have become common exfiltration paths because they move sensitive data in ways legacy DLP was not designed to inspect.
• The evidence points to a control gap, not just a user-behaviour problem, because legitimate identities and personal accounts can move data outside enterprise visibility.
• Practitioners should prioritize lineage, browser telemetry, and transfer-time enforcement so policy follows the data through prompts, uploads, and sync events.

Key terms

• Data exfiltration risk: Data exfiltration risk is the possibility that sensitive information leaves approved systems and enters an environment the organisation does not control. With Shadow AI, that often happens through ordinary user behaviour, which makes identity governance and data governance tightly linked rather than separate problems.
• Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.
• Browser-Mediated Exfiltration: Browser-mediated exfiltration is the movement of sensitive data through web apps, webmail, personal cloud accounts, uploads, and copy-paste actions inside the browser. It is difficult to stop with gateway controls because the data often never looks like a traditional file transfer.
• Prompt-Level Data Movement: Prompt-level data movement occurs when sensitive information is entered into an AI prompt and then processed, transformed, or reproduced by the model. This pattern defeats file-centric inspection because the data no longer looks like the original document once it has been embedded in the prompt or output.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management in practical terms. It helps security and identity practitioners connect identity controls to the wider governance problems their programmes already face.