Data loss threat modelling is shifting for AI-native exfiltration

At a glance

What this is: Orion argues that AI-native exfiltration breaks legacy DLP assumptions because modern data movement now flows through assistants, personal accounts, connected repositories, and MCP servers.

Why it matters: IAM, PAM, and security teams need data-loss controls that account for who or what is moving data, where it is going, and whether that destination is trusted in context.

Context

Data loss control depends on understanding not just what data exists, but how it can move and under whose authority. In AI-enabled environments, the boundary between sanctioned collaboration and exfiltration is blurred by assistants, connected apps, and delegated access paths that legacy DLP and DSPM were not designed to evaluate.

Orion's framework treats data movement as a sequence of source, destination, method, and trust decision rather than a static rule match. That matters for IAM and NHI governance because the security question is increasingly about identity-bound access to data flows, not simply whether a file is sensitive.

Key questions

Q: What breaks when AI assistants can move sensitive data outside traditional DLP paths?

A: Traditional DLP breaks when it assumes data will leave through predictable channels. AI assistants, connected repositories, and personal AI accounts create delegated paths that are hard to enumerate in advance, so policy matching alone misses risky transfers. Security teams need identity-aware, destination-aware enforcement at the moment of movement.

Q: Why do AI-native data flows increase the risk of exfiltration through trusted tools?

A: They increase risk because the trust decision often happens before the transfer. Once an assistant or connected app has access to a source repository, the movement can look legitimate even when the destination is unmanaged or personal. The issue is not just content sensitivity, but delegated authority crossing trust boundaries.

Q: What signals show that DSPM and DLP are not enough for AI-era data loss control?

A: A major sign is when teams can identify sensitive data, but cannot explain which AI tools, tokens, or connected apps can move it. Another is high volumes of false positives from path-based rules that still miss unusual destinations. That combination shows the control model is lagging actual data movement.

Q: How should teams govern MCP servers that need access to cloud data sources?

A: Treat the MCP server as a controlled identity workload, not as a place to store long-lived credentials. Use federation, short-lived tokens, and explicit role mapping so access remains auditable, revocable, and tied to the real user or workload that initiated the request.

Technical breakdown

Why static DLP breaks when data moves through AI assistants

Traditional DLP assumes data leaves through known channels that can be matched against predefined rules. That works poorly when a developer grants an AI assistant access to an entire codebase or a user connects a personal AI account to enterprise storage, because the control point shifts from egress inspection to delegated access. The security problem is no longer just content detection. It is whether the trust relationship behind the transfer is appropriate, whether the destination is sanctioned, and whether the action was initiated by a human, a workload, or a non-human workflow. In practice, this is a governance problem as much as a detection problem.

Practical implication: move controls from path-only inspection to identity-aware, context-aware decisioning at the point of data movement.

How exfiltration paths model destination trust and user context

A useful exfiltration model does not start with the tool, but with the route data takes from trusted source to untrusted destination. That route can include email, public links, USB devices, personal ChatGPT accounts, MCP servers, or connected enterprise repositories. The value of the model is that it captures user context, file context, transfer method, and enforcement point in the same sequence, which is what investigators need to determine whether the movement was legitimate or risky. For IAM teams, this is where identity governance intersects with data security: permissions, delegation, and destination trust all shape the path data can take.

Practical implication: inventory the destinations and delegation paths that can receive sensitive data, not just the data repositories themselves.

Why AI-native exfiltration creates a non-human identity governance problem

When autonomous agents, assistants, and connected applications can move information across systems, data loss is no longer only a human-user problem. These systems often operate with service credentials, delegated tokens, or persistent access to repositories and workflow tools, which means the path to exfiltration can be executed without a conventional user session. That creates an identity governance gap: teams may know where sensitive data lives, but not which non-human actors can move it, under what trust conditions, and with what destination awareness. This is where NHI governance becomes a control plane for data-loss prevention.

Practical implication: extend access governance and revocation discipline to assistants, agents, tokens, and connected applications that can move data.

Threat narrative

Attacker objective: The objective is to move sensitive enterprise data into an untrusted destination without triggering controls that were designed around older, more predictable leakage paths.

1. Entry occurs when a user grants an AI assistant, connected application, or MCP server access to a sensitive data source that would previously have been protected by narrower DLP assumptions.
2. Credentialed access or delegated trust then allows the non-human workflow to read, package, or forward information through a destination the organisation does not fully govern.
3. Impact follows when sensitive data leaves through a channel that legacy detection did not classify as exfiltration, leaving security teams with limited visibility and delayed response.

Breaches seen in the wild

• postmark-mcp malicious MCP server 2025: A fake Postmark MCP server on npm quietly BCC'd every email AI agents sent through it to an attacker, using victims' own Postmark tokens.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI-native exfiltration is now a governance problem, not just a content-detection problem. Static DLP assumes security teams can predict the route data will take. In AI-enabled environments, the route is increasingly shaped by delegated access, connected tools, and non-human workflows, so the control question shifts to who or what can move data and under what trust conditions. Practitioners should treat data movement policy as part of identity governance, not as an afterthought in the DLP stack.

Destination trust is the missing control variable in modern data loss models. Many security programmes still focus on where sensitive data lives, but AI assistants and connected repositories make destination trust the more consequential question. If the receiving system is personal, unmanaged, or lightly governed, the exfiltration risk is created before the file leaves the source. Teams should therefore model trust at the destination layer, especially where identity-bound access can cross organisational boundaries.

Non-human actors now sit inside the data-loss path. Autonomous agents, assistants, and connected apps are not merely tools that help users move data; they are increasingly the mechanism of movement itself. That means service credentials, tokens, delegated permissions, and workflow bindings must be governed as part of leakage prevention. The practical conclusion is clear: NHI governance has become a prerequisite for effective data-loss control.

Contextual enforcement is replacing path prediction as the useful security pattern. The article's core idea is that prevention has to evaluate user, system, destination, and method together at the moment data moves. That aligns with broader control thinking in NIST-CSF and NIST-800-53 because effective enforcement depends on access decisions, not only alerts. Practitioners should design for real-time authorization of movement, not retrospective explanation of loss.

From our research library:

• Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Security Guide

What this signals

AI-native data loss is forcing a shift from repository-centric control to movement-centric control. Teams that still anchor their programme on what data exists and where it is stored will miss the more important question of how that data can be transferred in context. The practical signal is that enforcement must sit closer to the transfer decision, especially where AI assistants or connected apps can initiate the move.

Non-human identity governance now intersects directly with data security. When agents, assistants, and connected workflows can act on enterprise data, their credentials, permissions, and destination rights become part of the loss-prevention boundary. That means NHI inventory, access scope, and revocation are no longer separate hygiene tasks. They are controls for reducing the probability of silent exfiltration.

For practitioners

• Model AI-native exfiltration paths Map the specific routes sensitive data can take through assistants, personal AI accounts, connected repositories, email, USB, and MCP servers, then compare them with current enforcement points.
• Extend governance to non-human actors Treat assistants, tokens, delegated workflows, and connected applications as governed identities when they can move sensitive data across systems.
• Validate destination trust before transfer Classify destinations as sanctioned, unmanaged, or personal, and use that classification as part of the allow or block decision for sensitive movement.
• Add investigative traces for movement decisions Record the user, file, destination, method, and enforcement outcome for each sensitive transfer so investigators can reconstruct why a movement was allowed.

Key takeaways

• AI assistants and connected apps change the exfiltration problem because they create data movement paths that legacy DLP policies were not built to recognise.
• The practical gap is not only in content detection, but in governing who or what is allowed to move data and where that data is allowed to go.
• For identity and security teams, non-human credentials, delegated access, and destination trust now belong in the same control discussion as sensitive-data classification.

Key terms

• AI-Native Exfiltration: AI-native exfiltration is the movement of sensitive data through assistants, connected apps, or agents in ways legacy leakage controls were not designed to recognise. It often looks like normal collaboration or workflow activity, which is why identity, destination trust, and transfer context matter as much as content sensitivity.
• Device Trust: Device trust is the confidence that a requesting endpoint is known, managed, and in a compliant state. It matters because identity alone does not prove safety. In zero trust programmes, device trust becomes one of the inputs used to decide whether access should be granted or sustained.
• Delegated access path: A delegated access path is the chain of identities, tokens, connectors, and approvals that lets one system act through another. It becomes a governance concern when the path outlives the original approval or can be reused for actions beyond the intended business purpose.
• Movement-Centric Control: Movement-centric control is a security approach that evaluates the full context of a transfer instead of relying only on static data classification or predefined egress rules. It combines user context, destination, method, and trust relationships to decide whether a specific data movement should be allowed.

Deepen your knowledge

The NHI Foundation Level course covers NHI governance, workload identity, and secrets management, plus the control patterns that matter when non-human actors can move data. It helps practitioners connect identity security with the operational decisions their programmes now face.