TL;DR: Generative AI has broken the old DLP model because data now moves through chats, agents, browsers, plugins, and embedded features, creating AI-specific leak paths that traditional file and endpoint controls do not fully see, according to Orion. The practical shift is from generic DLP coverage to scenario-based control over prompts, responses, agent behaviour, and API access.
At a glance
What this is: Orion maps how AI-enabled workflows create new data loss paths that traditional DLP was not designed to see or govern.
Why it matters: Security and IAM teams need to treat prompts, plugins, agents, and API calls as data movement surfaces, not just the endpoint and email channels legacy DLP assumed.
Context
Traditional DLP was built for a world where data loss mostly followed predictable paths such as email, file transfer, uploads, and endpoint copying. AI changes that model because sensitive content can be interpreted, transformed, and recombined inside chats, browsers, agents, and embedded features before it ever looks like a classic exfiltration event.
That creates a governance gap as much as a technical one. Security teams are no longer just trying to stop data from leaving approved channels, they are trying to understand which AI tools can touch enterprise data, which interactions are inspectable, and which controls actually apply to the new AI interaction layer.
Key questions
Q: What fails in traditional DLP when employees use AI tools with enterprise data?
A: Traditional DLP fails when data is no longer moving only through files, email, and endpoints. AI turns prompts, responses, plugins, and agent actions into new transfer paths, so controls built for static objects miss how data is interpreted and recombined. The practical failure is visibility first, then enforcement.
Q: Why do AI-driven data loss incidents create a bigger governance problem than classic exfiltration?
A: Because the risk is not just data leaving a boundary, it is data being used in ways that are hard to classify, trace, or prioritise. AI systems can transform content before disclosure occurs, which means teams need policy on behaviour, context, and access, not only on storage and transport.
Q: What are the signs that AI data leakage controls are not working?
A: Warning signs include employees using public GenAI tools without oversight, security teams unable to identify which tool was used, and no audit trail showing what data was shared. If investigations require reconstruction after the fact, the organisation has weak visibility. Slow answers during reviews or incidents usually point to a governance gap.
Q: How should organisations govern access to data used by AI systems?
A: Treat AI data access as an identity governance problem, not just a data storage problem. Define who or what can use each dataset, what purpose is allowed, and what runtime restrictions apply. Then review humans, service accounts, and AI agents separately so entitlement scope matches actual behaviour rather than a generic AI policy.
Technical breakdown
Why traditional DLP misses AI-driven data movement
Legacy DLP assumes data is a discrete object moving through known control points. AI breaks that assumption because the sensitive material can be entered as a prompt, returned in a response, embedded in a browser session, or forwarded through an agentic workflow. The risk is not limited to files leaving the perimeter. It also includes context leakage, oversharing, prompt injection, and output recombination, where the original data is transformed rather than copied. That makes static pattern matching far less reliable as the primary control model.
Practical implication: Treat prompts, responses, and agent actions as governed data flows, not just unstructured text events.
Where AI data loss happens across SaaS, endpoints, and agents
The article’s control model is useful because it separates surfaces from scenarios. Enterprise data begins in stores such as SaaS repositories or local endpoints, then flows into AI chatbots, AI browsers, endpoint-based agents, and SaaS AI features. In many environments these transfers are unmediated, which means there is no inspection point between the source system and the AI surface. That creates a visibility gap across identity, device, and application boundaries, especially when unmanaged tools are enabled by default or used outside approved channels.
Practical implication: Map data paths by surface so you can place controls where AI actually consumes enterprise information.
Why LLM firewall controls matter alongside SaaS and endpoint DLP
The article distinguishes between controls that protect the source and controls that govern the AI interaction layer. SaaS DLP and endpoint DLP still matter, but they do not inspect the AI conversation itself. An LLM firewall or equivalent control can inspect prompts and responses, monitor agent behaviour, and control plugin or API access. That is the technical hinge of the framework: governance must extend into the interaction layer where AI systems mediate access to data and external services.
Practical implication: Add AI-specific enforcement at the interaction layer instead of assuming source-system DLP is enough.
Threat narrative
Attacker objective: The objective is to extract or expose sensitive enterprise data through AI-mediated workflows without tripping traditional DLP controls.
- Entry occurs when employees paste internal documents into AI chats, use AI tools outside approved channels, or let embedded AI features access enterprise data.
- Credential and trust exposure follows when agents, plugins, or API-connected tools interact with internal systems and external services without clear oversight or traceability.
- Impact is data loss through prompt leakage, context leakage, oversharing, or unintended disclosure into external SaaS and identities.
Breaches seen in the wild
- SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI-driven data loss is now a governance problem, not just a detection problem. Traditional DLP assumes the loss event is visible at a file, email, or endpoint boundary. AI moves the risk into the interaction layer, where content is interpreted, recombined, and forwarded through tools that legacy controls do not understand. Practitioners should treat AI data movement as a policy and control-design issue, not merely a content-scanning issue.
AI prompts have become a new exfiltration surface. When users paste internal material into chat interfaces, the sensitive asset is no longer a static file but a live conversation. That changes the control objective from blocking transfer to governing use, context, and downstream exposure. The named concept here is prompt-borne leakage: sensitive data escapes through the conversational path rather than the transport layer. Practitioners should prioritise controls that inspect prompt and response flows.
Shadow AI and embedded AI features widen the identity and access gap. The article’s strongest signal is not just more AI, but AI that appears inside browsers, SaaS apps, developer tools, and internal systems, often enabled by default. That creates unauthorised access paths that look like normal user activity unless they are explicitly governed. Practitioners should inventory which AI surfaces can access enterprise data before they try to scale policy enforcement.
Agentic workflows require control over behaviour, not just data location. Once an agent can reach internal systems or external APIs, the key question is no longer where the data resides but what the agent is allowed to do with it. This is where identity governance intersects directly with AI security: permissions, delegated access, and plugin use all become part of the data loss problem. Practitioners should align AI controls with identity and API governance.
Scenario-based control testing is the right response to AI-era DLP fatigue. The article is pointing toward a more operational discipline: ask which AI-driven scenarios can actually be prevented, detected, or explained in your environment. That moves teams away from generic control checklists and toward testable governance. Practitioners should use scenario mapping to decide whether controls are missing, mis-scoped, or simply invisible.
What this signals
AI-driven data loss pushes DLP from content filtering into control-plane design. The old model asked whether a file matched a policy. The new model asks whether an AI surface can receive data, transform it, and forward it in a way the organisation can explain and govern. For practitioners, that means the control objective moves upstream to where data is consumed.
Prompt-borne leakage is the named risk category teams need to operationalise. Once internal material enters a chat interface, the exposure pathway is conversational and dynamic, not file-based. That makes prompt and response inspection, approved tool inventory, and agent oversight central to programme design. For IAM and security leads, this is where identity governance and data governance start to intersect directly.
Shadow AI will keep widening the gap between policy and practice unless discovery is continuous. AI embedded in browsers, SaaS apps, and developer tools will not wait for a formal rollout plan. Practitioners should expect governance drift unless they can continuously identify which AI surfaces are in use and which ones can touch enterprise data.
For practitioners
- Build an AI data-flow inventory Map which AI tools, browser features, agents, and plugins can touch enterprise data, then classify the paths by approved and unapproved use.
- Extend DLP to AI interaction points Add inspection for prompts and responses where AI systems mediate access, rather than relying only on file, email, and endpoint controls.
- Control agent and plugin access to data Treat agent behaviour, plugin destinations, and AI-connected API calls as governed access paths with explicit approval and review.
- Test controls against real AI scenarios Use scenario-based validation to check whether prompt leakage, context leakage, and oversharing can actually be detected or blocked.
- Separate approved from unmanaged AI use Identify where AI tools are enabled by default or adopted outside policy so you can close shadow AI exposure before it becomes routine.
Key takeaways
- AI changes data loss from a boundary problem into an interaction problem because prompts, responses, agents, and plugins can all expose sensitive material.
- The framework in the source article separates risk types, scenarios, and surfaces so teams can decide where visibility and enforcement are missing.
- Practitioners should move beyond generic DLP coverage and validate whether AI-specific flows can actually be inspected, controlled, and explained.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | AI agents and plugin access create governed privilege paths in this article. |
| ASI02 — Tool Misuse | The article centres on agents, plugins, and API calls used beyond intended controls. | |
| ASI07 — Insecure Inter-Agent Communication | Prompt, response, and embedded-AI flows create unsafe data movement between systems. | |
| Recommendation — Constrain agent permissions and monitor delegated access to prevent privilege abuse. Restrict tool invocation paths and validate which actions each agent can perform. Inspect inter-agent and AI-to-system exchanges for unauthorised data transfer. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | AI tools and agents accessing internal systems depend on governed authentication and trust. |
| Recommendation — Harden authentication for AI-connected systems and revoke weak trust paths. | ||
| MITRE ATT&CK | TA0009;TA0010 — Collection; Exfiltration | The article describes sensitive data being collected and moved through AI workflows. |
| Recommendation — Map AI data-loss scenarios to collection and exfiltration behaviours in detection rules. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about governing which AI surfaces can access enterprise data. |
| Recommendation — Review AI tool entitlements and remove access that is not explicitly approved. | ||
Key terms
- Prompt-Borne Leakage: Sensitive information exposed through prompts or conversations with AI systems rather than through a traditional file transfer. The risk arises when users or agents place internal content into model inputs that may be retained, transformed, forwarded, or echoed in ways legacy DLP cannot see.
- AI Interaction-Layer Exposure: Exposure that occurs when sensitive data is shared with or transformed by AI-enabled interfaces instead of leaving through a conventional file transfer. The risk is that classic DLP sees neither the original context nor the final output, even though business-sensitive information has effectively been disclosed.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Scenario-Based DLP: A DLP approach that tests specific data-loss situations across tools, surfaces, and workflows rather than relying only on generic content rules. It is more useful in AI-heavy environments because the question shifts from detecting a keyword to governing an interaction.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It helps identity and security practitioners build the control thinking needed for AI-mediated access and data flows.
Published by the NHIMG editorial team on August 14, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org