AI data leakage is now a governance problem, not just a DLP problem

At a glance

What this is: This analysis argues that AI-era data leakage is driven by ordinary work patterns, with prompts, uploads, copilots, AI agents, and MCP workflows moving sensitive data beyond traditional controls.

Why it matters: It matters because IAM, NHI, and data security teams now have to govern who or what can move sensitive information, not just who can authenticate or access a system.

By the numbers:

• 39% of EMEA employees use free AI tools at work, creating shadow AI governance gaps for security teams.
• 17% of EMEA employees use AI tools they pay for privately, adding another unmanaged channel for sensitive data movement.
• 63% of surveyed organisations had no AI governance policies in place to manage AI or prevent workers from using shadow AI.
• 97% of organisations with AI-related security incidents said they did not have proper AI access controls.

👉 Read Nightfall's analysis of how to let employees use AI without leaking company data

Context

AI data leakage is a governance problem because the boundaries that once contained sensitive information are now blurred by prompts, uploads, browser sessions, copilots, and autonomous agent activity. The primary challenge for security teams is no longer only where data is stored, but how it moves through normal work and whether controls can still see it in transit. That is especially relevant where AI systems touch credentials, source code, customer records, and regulated data.

Nightfall’s article is best read as an argument for runtime control over AI-era data movement, not as a product feature summary. The identity intersection is real: service accounts, AI agents, browser sessions, and MCP workflows all act like data-moving identities, which means IAM and NHI teams have to care about visibility, authorisation, and policy enforcement beyond traditional login events.

Key questions

Q: How should security teams govern sensitive data used by AI systems?

A: Security teams should treat AI as a data consumer that needs policy boundaries, not just authentication. Classify sensitive data, define which datasets may enter AI workflows, and monitor outputs, logs, and downstream reuse. If governance stops at login, the organisation can approve access while still losing control of the data itself.

Q: Why do copilots and AI agents create new leakage risks for enterprise data?

A: Copilots and AI agents can retrieve, transform, and transmit data across multiple systems without the same friction as manual workflows. That compresses the time between access and exposure, while also making destination visibility weaker. The risk rises further when employees use unapproved tools or when agents operate through MCP-connected applications.

Q: What do organisations get wrong about shadow AI governance?

A: They often try to block unsanctioned tools at the network layer without changing employee behaviour or providing an approved alternative. That pushes use to personal devices and leaves the enterprise blind. Discovery and policy-guided redirection are more useful than simple denial if the goal is control rather than displacement.

Q: How can teams reduce AI leakage risk without slowing adoption?

A: By designing for containment and recovery instead of relying on perfect prevention. That means isolating sensitive data sources, tightening access to retrieval layers, and preparing purge or restore workflows for accidental disclosure. This approach keeps AI usable while reducing the blast radius when content escapes its intended context.

Technical breakdown

Why prompt-based data movement defeats legacy DLP

Legacy DLP was built to inspect email, file shares, and endpoint transfers. AI prompts change the problem because sensitive material can be embedded in natural language, paraphrased, or uploaded through browser-based interfaces that look like ordinary web traffic. Static rules struggle here because the data’s meaning matters more than its format. AI-native detection tries to classify intent and content together so security teams can spot confidential code, regulated records, or credentials before they leave the organisation.

Practical implication: inspect prompts and uploads in real time rather than relying on batch scanning or pattern matching alone.

How shadow AI creates a blind spot for identity and data governance

Shadow AI emerges when employees use unapproved tools, paid subscriptions, or consumer services outside enterprise governance. That creates a control gap because the organisation may still authenticate the user, but it loses sight of the destination, retention model, and downstream reuse of the data. For IAM and NHI programmes, the issue is not only identity proofing but policy enforcement across every system that receives data from an authenticated user or agent.

Practical implication: inventory AI tools by data path and apply policy based on destination, not just user identity.

Why RAG and agentic workflows need access controls at the data layer

Retrieval-augmented generation and AI agents are not just consumers of data. They retrieve, transform, and resend information across systems, which means permission drift can appear inside the workflow even when the original source is governed. MCP makes this more complex because agent tool calls can expose data movement across multiple systems in a single session. The control problem is therefore not only access to the model, but access to the underlying data sources and the actions the agent can trigger.

Practical implication: govern agent tool calls and retrieval permissions with the same discipline used for privileged access.

Threat narrative

Attacker objective: The attacker objective is to capture or elicit sensitive enterprise data through AI interaction paths that bypass traditional exfiltration monitoring.

1. Entry begins when employees paste sensitive content, upload files, or authorize AI tools that sit outside approved governance channels.
2. Escalation occurs when copilots, RAG systems, or agents retrieve additional data through connected apps and MCP workflows beyond the original user intent.
3. Impact is the exposure of proprietary code, credentials, regulated records, or customer data into external AI systems where visibility and revocation are limited.

NHI Mgmt Group analysis

AI-era data leakage is now an identity problem as much as a content problem. Once prompts, copilots, and agents can move sensitive information across systems, the security boundary shifts from file handling to governed data movement. That means IAM, PAM, and NHI teams need to think about who or what can transmit data, not only who can log in. The practitioner conclusion is that identity governance must extend into runtime AI workflows.

Shadow AI governance gaps are the clearest evidence that policy-by-approval is failing. Employees do not need malicious intent to create exposure when consumer AI tools are one browser tab away. The organisational failure is not awareness alone, but lack of enforceable controls at the point of use. The practitioner conclusion is that approved use cases and blocked destinations must be mapped together.

MCP and agentic workflows create a new class of data-moving identities. An AI agent can function like a non-human identity with delegated retrieval and transmission rights across SaaS, email, and developer tooling. That makes least privilege and lifecycle control relevant to agentic systems in the same way they are for service accounts. The practitioner conclusion is to treat agents as governed identities with explicit boundaries.

Data security posture management is not enough when the risk is in motion. DSPM helps find sensitive data at rest, but AI leakage often happens before data is stored anywhere new. Runtime interception, classification, and remediation are now the decisive controls because they act before exposure becomes irreversible. The practitioner conclusion is to align DSPM with active data exfiltration prevention.

Named concept: AI data movement governance. This article makes clear that the security challenge is not AI itself, but the movement of sensitive data through AI-enabled work. Once that movement spans humans, copilots, agents, browsers, and MCP servers, governance becomes an orchestration problem across identity, policy, and runtime enforcement. The practitioner conclusion is to build controls around movement paths, not just systems of record.

What this signals

AI data movement governance will become a programme-level requirement as organisations discover that prompts, uploads, and agent tool calls are now part of the exfiltration surface. Security leaders should expect the next control conversation to centre on how data exits the organisation, not only how it is classified at rest.

A useful planning signal is the gap between visibility and control. Where teams can see AI usage but cannot stop risky transfers, they have monitoring, not governance. That gap is especially relevant for IAM and NHI teams because delegated access is now carried through browser sessions, copilots, and agent workflows as much as through conventional accounts.

For reader programmes, the practical shift is to align identity policy with data protection policy. When AI systems can act with delegated access, the relevant question becomes whether access is limited, auditable, and revocable across every route the data can take, including MCP-connected services and external AI tools.

For practitioners

• Map AI data movement paths Inventory where sensitive data can enter prompts, uploads, agent requests, browser sessions, and MCP tool calls, then classify each path by business risk and regulatory impact.
• Enforce runtime prompt inspection Block, redact, or coach users before sensitive content reaches external AI services, especially for source code, credentials, customer records, and regulated data.
• Treat AI agents as governed identities Assign explicit permissions, retrieval boundaries, and revocation rules to agents and copilots so delegated access is time-bound and reviewable.
• Close shadow AI gaps with discovery and policy Identify consumer AI tools, privately paid subscriptions, and unapproved copilots, then apply destination-based controls rather than relying on user trust alone.
• Align DSPM with active exfiltration prevention Use DSPM to locate sensitive data, then pair it with real-time controls that stop data from leaving through AI workflows before exposure occurs.

Key takeaways

• AI adoption is expanding the exfiltration surface from file sharing into prompts, copilots, agents, browsers, and MCP workflows.
• Shadow AI and unmanaged agent behaviour create governance gaps that traditional DLP and IAM controls were not built to close on their own.
• Real-time classification, interception, and revocation are now the controls that determine whether AI use is enabled safely or becomes a leakage channel.

Key terms

• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• AI Data Governance: AI data governance is the set of rules, ownership decisions, and enforcement mechanisms that determine how data can be used by AI systems. It covers classification, access control, retention, and remediation, and it must account for both human users and autonomous software entities.
• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Runtime Data Exfiltration Prevention: Runtime data exfiltration prevention is the practice of stopping sensitive data from leaving an environment at the moment it is about to move. Unlike batch scanning or retrospective discovery, it focuses on immediate classification, blocking, redaction, or remediation across live user and agent activity.

What's in the full article

Nightfall's full blog post covers the operational detail this post intentionally leaves for the source:

• Runtime detection examples for prompt-based leakage across SaaS, email, browsers, and AI apps
• Control options for blocking, redacting, quarantining, and revoking risky data movement in real time
• Examples of how AI agents and MCP workflows are inspected and governed across connected systems
• Implementation considerations for teams deciding where DLP stops and active exfiltration prevention begins

👉 Nightfall's full post covers the AI leakage vectors, runtime control options, and governance questions in more operational detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners build the control discipline needed for delegated access and runtime enforcement.