AI data leakage is now a governance problem, not just a DLP problem

At a glance

What this is: Nightfall argues that AI-era data leakage is a governance problem because sensitive information now moves through prompts, copilots, agents and MCP workflows outside traditional DLP assumptions.

Why it matters: IAM, NHI and security teams need governance that understands who or what is moving data, because real-time control now matters as much as data discovery.

By the numbers:

• 39% of EMEA employees use free AI tools at work, creating shadow AI governance gaps for security teams.
• 17% of EMEA employees use AI tools they pay for privately, adding another unmanaged data movement path.
• Nightfall says 95% precision out of the box is achievable for AI-native detection compared with 5-25% legacy DLP baselines.

Context

AI data leakage is no longer limited to obvious file transfers or email attachments. In this article, Nightfall frames the problem as a governance gap created by generative AI, copilots, AI agents and MCP workflows that move sensitive content through ordinary work paths.

The security issue is not just where data sits, but how it moves across human and machine workflows. That makes the question one of runtime control, access scope and visibility, especially where shadow AI and autonomous retrieval blur the line between user action and system action.

Key questions

Q: How should security teams govern data leakage across copilots, agents and MCP workflows?

A: Security teams should treat AI-assisted data movement as a governed workflow, not a side channel. That means discovery across endpoints, browsers and SaaS, contextual inspection before data leaves approved boundaries, and policy enforcement that can block, redact or coach in real time. Delegated agent access also needs explicit scope and revocation.

Q: Why does shadow AI create a governance gap for IAM and security teams?

A: Shadow AI creates a governance gap because organizations cannot manage systems they do not reliably see. If AI apps, agents, and plugin connections live outside the approved inventory, then policy, risk assessment, and monitoring all start from incomplete assumptions. IAM and security teams need discovery that captures real usage, not only sanctioned assets.

Q: What are the signs that AI usage controls are not working as intended?

A: Common warning signs include sudden token spikes, repeated 429 responses, uneven consumption across users, and budget overruns that appear before the quarter ends. Another indicator is when lower-priority users consume premium model capacity that should have been reserved for higher tiers. If these patterns show up, the policy design is too loose or the thresholds are not being reviewed.

Q: How can organisations balance AI productivity with identity security?

A: Organisations can balance AI productivity with identity security by making secure access the easiest path, not the exception path. That means using governed access workflows, limiting credential visibility, and designing controls that work at machine speed. If the process is too manual, users bypass it; if it is too open, secrets proliferate.

Technical breakdown

Why prompts and agent calls evade legacy DLP

Legacy DLP was designed for discrete events such as attachments, file copies and obvious exfiltration channels. AI workflows break that model because prompts, browser sessions, tool calls and agent requests can carry sensitive meaning without looking like classic transfers. When a copilot or agent retrieves data from connected systems, the control point moves from storage to runtime. That means pattern matching alone misses context, while delayed scanning finds exposure after the data has already moved. The core architectural shift is from watching where data rests to inspecting where data is about to go.

Practical implication: place controls at submission and retrieval time, not only at rest or after-the-fact review.

How shadow AI turns normal work into uncontrolled data movement

Shadow AI is any unapproved or unmanaged AI tool operating outside governance workflows. Employees often reach for these tools because they are faster than approved paths, but the security consequence is that sensitive material can bypass enterprise policy without any malicious intent. The issue is not only tool sprawl. It is that free and privately paid AI services create data flows the organisation cannot classify, block or audit consistently. In practice, shadow AI creates a parallel data plane where acceptable use and technical enforcement drift apart.

Practical implication: discover unmanaged AI use across browsers, endpoints and SaaS before policy can be enforced credibly.

Why MCP and AI agents expand the governance boundary

MCP workflows and AI agents add machine-initiated access to the problem. Instead of a person manually uploading a file, an agent can retrieve content, transform it and transmit it across systems with minimal human oversight. That changes governance because the actor moving data may be a user, a copilot, an endpoint process or an AI agent using delegated access. For identity and access teams, this is where agentic AI meets NHI governance: the data path is controlled by credentials, permissions and tool permissions that were not designed for autonomous execution.

Practical implication: govern agent permissions and tool access as part of the same control model you use for sensitive human access.

Threat narrative

Attacker objective: The end state is uncontrolled disclosure of sensitive company data through AI-enabled workflows that bypass traditional DLP visibility.

1. Entry occurs when employees use free or privately paid AI tools, copilot features or browser-based AI interactions outside approved governance workflows.
2. Credential or content exposure follows when users paste source code, financial records, customer data or regulated information into prompts, uploads or retrieval requests.
3. Escalation happens when copilots, AI agents or MCP tool calls fetch additional data from connected systems beyond the original user-intended scope.
4. Impact is sensitive information leaving approved boundaries without timely visibility, blocking or remediation, increasing breach cost and compliance exposure.

Breaches seen in the wild

• Samsung ChatGPT leak 2023: Samsung staff pasted chip source code and meeting notes into ChatGPT weeks after it was allowed, leading Samsung to restrict generative AI tools.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Shadow AI is now a governance defect, not a user-training problem. The article’s core point is that employees will adopt AI tools wherever those tools accelerate work, whether or not they are approved. That means the control gap sits in discovery, policy enforcement and runtime interception rather than in awareness alone. The practical implication is that teams must govern AI use as a sanctioned data flow, not as an exception to policy.

Agentic data leakage changes the unit of control from files to actions. Traditional DLP assumes data can be classified once and then watched at a boundary. AI agents and copilot workflows break that assumption because they retrieve, transform and forward data dynamically across multiple systems. The result is a governance problem around delegated access and machine-initiated movement, which is why NHI and agent permissions now matter to data security. The practical implication is that access scope must be governed at the moment of retrieval, not only at the point of storage.

AI-era data security needs policy that can understand context, not just content. Prompt text, browser activity and MCP tool calls can all carry the same sensitive information in different forms. A keyword or regex-first approach misses that reality, while contextual inspection can distinguish legitimate work from risky disclosure. The practical implication is that organisations should measure control quality by whether the system can recognise risky movement across channels, not just by alert volume.

Machine identity and human identity are converging in the same leakage path. When an AI agent accesses data through MCP or other delegated workflows, the organisation is effectively trusting an identity that acts continuously and at machine speed. That puts NHI governance into the centre of data protection rather than at the margins. The practical implication is that security teams should align access policy, telemetry and revocation logic across humans, copilots and agents.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Security Guide

What this signals

AI data leakage is becoming a policy-design problem. Security programmes that still rely on static DLP patterns will miss the operational reality of prompts, browser sessions and agent tool calls. The control objective is no longer just to detect exposure, but to stop sensitive movement before external AI systems process it.

Agentic workflows widen the identity boundary of data protection. Once an AI agent can retrieve or forward information on behalf of a user, access decisions become part of the data-security stack. That means NHI governance, entitlement scoping and auditability now sit alongside classification and exfiltration controls.

Over-privileged AI access raises incident likelihood materially. Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.

For practitioners

• Deploy runtime inspection at the point of data movement Inspect prompts, uploads, browser sessions and agent requests before sensitive content reaches external AI services or connected systems.
• Discover shadow AI across managed endpoints and browsers Identify free, privately paid and otherwise unmanaged AI tools that employees are already using so policy can follow actual workflows.
• Extend NHI governance to agents and MCP workflows Treat AI agents, delegated tool calls and MCP server access as governed identities with explicit scope, auditability and revocation paths.
• Classify sensitive data by context before transmission Use contextual detection for source code, credentials, financial data and regulated records so enforcement can block, coach or redact in real time.

Key takeaways

• AI leakage now spans prompts, uploads, copilots, agents and MCP workflows, so the control problem is runtime governance rather than simple file blocking.
• Shadow AI turns ordinary employee productivity into an unsanctioned data plane that traditional DLP cannot reliably see or stop.
• Identity, entitlement scope and contextual inspection all matter because AI agents can move sensitive data at machine speed without a human in the loop.

Key terms

• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• MCP Workflow: An MCP workflow is the sequence of steps an AI agent follows when using the Model Context Protocol to request tools, data, or actions. It defines how the agent discovers capabilities, sends structured requests, receives responses, and continues execution. In security terms, it creates a governed path for agent-to-system interaction.
• Runtime Data Access: Runtime data access is the live retrieval of production data by an AI system while it is operating. It is the highest-risk governance stage because sensitive information can be exposed, transformed, or acted on at machine speed before human review can intervene.
• AI-native DLP: AI-native DLP is data loss prevention designed to understand how AI systems create, move, and expose sensitive information. It inspects prompts, model outputs, embeddings, agent actions, and connected tools to detect leakage, misuse, or policy violations. It applies controls across AI workflows, not only traditional files, email, or endpoints.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and machine identity security. It helps security and identity practitioners connect delegated access, lifecycle control and auditability to real-world governance.