TL;DR: ChatGPT is creating a new data-loss surface because employees paste source code, customer records, financial models, and internal documents into browser prompts that legacy DLP never sees, according to Orion. The control problem is no longer whether teams will use AI, but whether security can classify and stop sensitive text at the point of entry.
At a glance
What this is: Orion says ChatGPT use creates a browser-paste data-loss problem that legacy DLP misses because sensitive text is entered directly into prompts.
Why it matters: This matters because IAM and security teams must govern how employees use AI tools without relying on controls built for files, email, or network egress.
Context
ChatGPT DLP is a governance problem because sensitive information is now being entered into a browser session rather than moved through the channels legacy controls were designed to inspect. When the security model assumes data leaves as a file, message, or attachment, a pasted prompt becomes invisible risk.
The identity angle is real because the account may be governed while the behaviour is not. ChatGPT Enterprise can secure authentication and tenancy, but it does not stop users from typing protected content into a prompt, which shifts the control question from access to data handling at the moment of use.
This pattern is already typical in enterprise settings, not an edge case, because employees use generative AI to move faster on code, customer work, and analysis.
Key questions
Q: What breaks when employees paste sensitive data into ChatGPT?
A: The break is control over where the data goes next. Once sensitive material enters a cloud AI service, it may be processed, stored, logged, or reused outside the organisation's intended boundary. That creates exposure for secrets, personal data, and IP unless the business has explicit rules for what may be entered and how output can be reused.
Q: Why is ChatGPT prompt leakage a governance problem rather than just a user-training issue?
A: Because the risk comes from ordinary work being done in a new data surface, not just careless behaviour. Even well-intentioned users can paste code, records, or models into prompts, so the control has to evaluate content at the point of use, not rely on awareness alone.
Q: How do security teams tell whether AI controls are actually stopping data loss?
A: Look for whether the control can classify sensitive text in real time and apply different responses based on context. If it only logs activity after submission, users still retain a path to disclose data. Effective control reduces both successful leakage and the incentive to bypass it.
Q: When should organisations restrict ChatGPT use instead of allowing it broadly?
A: They should restrict it whenever the workflow involves sensitive data, regulated records, source code, or operational instructions that could cause harm if exposed or misused. Broad approval works only when the organisation can classify inputs, govern outputs, and enforce acceptable-use rules consistently across teams.
Technical breakdown
Why browser-pasted prompts evade legacy DLP
Legacy DLP was built around inspection points such as email gateways, file shares, USB ports, and network egress. A ChatGPT prompt is different because the sensitive content is entered as free text inside an active browser session, often before it becomes a file or leaves through a monitored channel. That means pattern matching on file fingerprints or known labels misses the actual leak event. In practice, the control has to see what the user is about to send, not just what later traverses the network.
Practical implication: Deploy inspection at the browser or endpoint so the prompt can be evaluated before submission.
Why account security is not the same as data loss prevention
ChatGPT Enterprise-style controls secure the tenant, the login, and the administrative boundary, but they do not govern the content a user chooses to paste. That distinction matters because account control reduces misuse of the platform, while DLP reduces disclosure of the information itself. In governance terms, one control manages who can enter the system and the other manages what they can place into it. They solve different parts of the risk.
Practical implication: Treat SSO and retention settings as platform controls, not substitutes for prompt-time data controls.
How intent and context change the control model
Prompt inspection becomes more useful when it is not a blunt block. The useful model is to classify the text, understand the destination, and decide whether the action is safe in context. That is how teams avoid forcing users into personal AI accounts when a policy is too rigid. The architecture therefore needs real-time classification, contextual scoring, and a response path that can redact, coach, or stop without turning every event into a manual review.
Practical implication: Use context-aware policy so legitimate AI adoption is preserved while sensitive data is intercepted.
Threat narrative
Attacker objective: The practical objective is disclosure of sensitive enterprise text outside the organisation's governed DLP controls, whether through careless use or malicious prompting.
- Entry occurs when an employee pastes source code, customer data, or internal documents into a ChatGPT prompt from a browser tab or desktop app.
- Credential or account controls do not stop the event because the sensitive material is disclosed by the user at the point of entry rather than stolen through a login compromise.
- Impact occurs when the prompt reaches the external AI service and the organisation loses visibility and control over the sensitive text.
Breaches seen in the wild
- Samsung ChatGPT leak 2023: Samsung staff pasted chip source code and meeting notes into ChatGPT weeks after it was allowed, leading Samsung to restrict generative AI tools.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Browser-prompt exposure is a distinct governance problem, not a DLP tuning issue. When sensitive text is pasted into an AI chat surface, the organisation is no longer dealing with file movement or email exfiltration. The control boundary has shifted to the moment of human interaction, which means governance must move closer to the user action itself.
Account-level AI security does not close the data-loss gap. Authentication, tenancy controls, and admin settings reduce platform abuse, but they do not classify or stop what a user types. That gap becomes material whenever employees use sanctioned AI for code, finance, HR, or customer work, because the disclosure happens before any downstream platform control can help.
Prompt-time inspection is becoming part of identity governance. Once AI tools become normal work surfaces, the organisation has to govern not only access to the tool but the use of sensitive data inside it. That is especially relevant to IAM and identity-adjacent programmes because the user is authenticated while the data is still ungoverned, creating a control gap between identity assurance and information handling.
ChatGPT DLP is really a classified-data boundary problem. The decisive issue is not whether employees can use AI, but whether the organisation can distinguish safe from unsafe text at the point of entry. Security teams that treat this as a new kind of browser-side data governance will design better controls than teams waiting for legacy DLP to notice a prompt after the fact.
Browser-pasted prompts are now part of the secret-sprawl challenge. Secret leakage no longer depends only on repositories and pipelines. It also appears in ordinary employee workflows where source code, records, and models are copied into AI tools, which means the secret boundary now extends to everyday productivity software.
From our research library:
- Internal repositories are 6x more likely to contain secrets than public ones (32.2% vs 5.6%), contradicting the assumption that private repos are safe, according to the State of Secrets Sprawl 2026.
- Read next: Guide to the Secret Sprawl Challenge
What this signals
Prompt-time data inspection is becoming part of identity governance. The organisation now has to govern not only who can access an AI tool, but what those authenticated users are allowed to disclose inside it. That makes browser-side prompt controls relevant to IAM, not just DLP, because identity assurance ends only when data handling is governed too.
Secret leakage is moving into everyday productivity workflows. Once source code, customer records, and financial models are copied into AI prompts, the secret boundary extends beyond repositories and pipelines. Teams that still think of leakage as a storage problem will miss the operational reality of employee-driven disclosure at the point of entry.
For practitioners
- Implement prompt-time data inspection Inspect pasted or typed content in the browser and endpoint before it is submitted to ChatGPT or similar tools, with actions for redact, warn, or block.
- Classify the data employees actually paste Build policies around the data types that matter in practice, including source code, customer records, financial models, and internal documents.
- Separate platform security from data governance Keep SSO, tenant administration, and retention controls in place, but do not treat them as DLP because they do not stop disclosure in the prompt.
- Cover sanctioned and shadow AI surfaces Apply the same inspection logic across browser tabs, desktop apps, and unsanctioned accounts so users cannot bypass controls by switching surfaces.
- Tune controls to preserve adoption Use intent and context to reduce false positives so employees can keep using AI tools without moving sensitive work to unmanaged personal accounts.
Key takeaways
- ChatGPT prompt leakage is a data-governance failure because sensitive text is entered directly into a browser session that legacy DLP was never designed to inspect.
- The control gap is between authenticated use and controlled disclosure, which is why account security and data loss prevention are not interchangeable.
- Prompt-time inspection, context-aware policy, and coverage across sanctioned and shadow AI are the controls that change the outcome.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Prompt pasting exposes sensitive text into AI tools, which maps to secret leakage beyond repositories. |
| NHI-10 — Human Use of NHI | Employees using ChatGPT as part of work are human operators handling a non-human service channel. | |
| Recommendation — Apply secret-leak controls to browser prompts and block disclosure before sensitive text reaches AI services. Govern human use of AI tools with policies that control what users may disclose, not just who may log in. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article distinguishes authenticated access from allowed data disclosure inside the tool. |
| Recommendation — Separate access control from content control so authorised users still cannot disclose protected data unsafely. | ||
| CIS Controls v8 | CIS-5 — Account Management | ChatGPT Enterprise secures the account layer, but account management alone does not prevent prompt leakage. |
| Recommendation — Pair account management with prompt inspection so identity controls do not become a false sense of data protection. | ||
| MITRE ATT&CK | TA0009;TA0010 — Collection; Exfiltration | The leak pattern is collection by user action followed by disclosure to an external service. |
| Recommendation — Map prompt-paste leakage to collection and exfiltration behaviours in your threat model and detection logic. | ||
Key terms
- Prompt-time inspection: Prompt-time inspection is the evaluation of text before it is submitted to an AI system. It classifies sensitive content in the moment of entry so the organisation can redact, warn, or block disclosure before data leaves the user’s control.
- Browser DLP: Browser DLP is policy enforcement applied to web sessions and browser-based uploads. It matters because SaaS apps, webmail, and generative AI tools now act as primary data exit points, so organisations need controls that can inspect and stop transfers in the browser, not only in backend gateways.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Identity-governed disclosure: Identity-governed disclosure is the idea that authenticated use of a system is not enough unless the organisation also governs what the user may reveal inside it. It connects access control with content control, especially in AI-enabled workflows.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need a working view of governance, risk, and control across modern identity programmes.
Published by the NHIMG editorial team on August 14, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org