DLP for GenAI exposes the limits of legacy data controls

At a glance

What this is: Cyberhaven argues that legacy DLP is not designed for GenAI because employee data now moves into chat prompts, AI assistants, and agentic workflows rather than fixed transfer channels.

Why it matters: IAM, data security, and NHI teams need governance that follows data into AI tools, because prompt-based leakage and automated agent flows bypass controls built for email and file transfer.

Context

DLP for GenAI addresses a governance gap, not a narrow content-filtering problem. Legacy controls were built around known transfer points such as email, USB, and file upload, while AI usage now includes copy-paste prompts, browser-based assistants, and agentic workflows that do not look like traditional exfiltration paths.

The security issue is that data can leave a controlled repository, lose its file boundaries, and reappear inside an AI tool with different handling terms, retention rules, or training behaviour. That creates an intersection between data security, IAM governance, and NHI oversight when AI agents access information on behalf of users.

Key questions

Q: How should organisations control sensitive data in GenAI tools?

A: Organisations should treat prompts, uploads, and model outputs as governed data flows, then apply classification, inspection, and logging at the point of use. The control objective is to stop sensitive information from entering AI workflows without visibility. That requires policy, access rules, and monitoring to work together, not as separate programmes.

Q: Why do legacy DLP controls fail against AI prompts and copilots?

A: Legacy DLP fails because it assumes data moves through fixed channels such as email, files, or USB, while AI prompts often move as copied text through browser interfaces or embedded copilots. That removes the file boundary legacy tools rely on and makes source context more important than pattern matching alone.

Q: What are the signs that data governance is too weak for safe GenAI adoption?

A: Warning signs include widespread oversharing, unclear classification labels, inconsistent group membership, and access-control lists that are not kept current during onboarding and offboarding. Another indicator is when teams rely on broad organisational access instead of tightly scoped permissions. In that environment, GenAI tools can expose data governance gaps rather than safely containing them.

Q: How should organisations control AI agents that query sensitive business data?

A: Treat agents as governed identities with bounded purpose, not as open-ended query clients. Apply attribute and purpose checks, restrict raw field access, and default to aggregation or masking unless the request is explicitly justified. That keeps AI usage within policy and prevents agents from becoming a shortcut around human approval controls.

Technical breakdown

Why legacy DLP misses prompt-based data movement

Traditional DLP assumes data travels as discrete objects through predictable channels. It inspects attachments, file transfers, and outbound messages, then applies pattern matching to detect sensitive content. GenAI breaks that model because a user can copy text from a confidential document, paste it into a prompt, and never create the file event that perimeter tools are designed to intercept. The security problem is not only content detection. It is preserving the link between the data and its source after the data has been reformatted into conversational text.

Practical implication: shift policy enforcement closer to the endpoint and source classification, not just the network edge.

How data lineage changes AI data governance

Data lineage tracks where information came from, how it moved, and what transformations it passed through. In a GenAI context, that matters because the sensitivity of pasted text is often easier to establish from its origin than from its final form. Lineage gives DLP context that pattern matching lacks. Instead of asking only whether a prompt looks sensitive, a control can ask whether the text originated in a confidential source, whether it was copied into an AI tool, and whether the destination is allowed to receive that class of data.

Practical implication: classify source data once and carry that classification through AI submission controls.

Why AI agents create a separate control problem

AI agents do not behave like human users. They query systems, assemble outputs, and pass results between tools automatically, which means their data access path can span multiple applications inside a single workflow. A DLP control focused on human paste actions will miss most of that activity. The governance issue here overlaps with NHI and agentic AI security because the agent is a non-human actor using delegated access, often with little human visibility into which data it touched or emitted.

Practical implication: extend monitoring and approval logic to agentic workflows, not only employee prompts.

Threat narrative

Attacker objective: The practical objective is not always an external attacker. In this pattern, the outcome is sensitive enterprise data entering AI systems where it can be retained, reused, or exposed beyond intended governance boundaries.

1. Entry occurs when employees paste confidential text, records, or code into GenAI tools that were never governed as sanctioned data destinations.
2. Credential or policy boundaries are bypassed because the submission happens through prompts, browser interfaces, or automated agent workflows instead of traditional file-transfer channels.
3. Impact is the persistence or reuse of sensitive data outside enterprise control, including model training exposure, stored chat history, and unauthorized propagation across AI-enabled systems.

Breaches seen in the wild

• Samsung ChatGPT leak 2023: Samsung staff pasted chip source code and meeting notes into ChatGPT weeks after it was allowed, leading Samsung to restrict generative AI tools.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Legacy DLP has become a channel-control problem in an AI workflow world: controls built for email, USB, and file transfer cannot reliably govern copy-paste submission into GenAI tools. The gap is not only technical detection but policy scope, because the same data can now enter sanctioned and unsanctioned AI services through browser interfaces and embedded copilots. Practitioners should treat GenAI as a new data egress class, not as another messaging channel.

Data lineage is the control concept legacy DLP never had: the decisive question is no longer whether text looks sensitive in isolation, but whether it came from a governed source that should remain restricted. That shifts the control plane from pattern recognition to provenance-aware enforcement. For identity and access teams, this also matters because governance must follow the data path, not just the user session.

Shadow AI creates inventory debt, not just usage risk: when hundreds of AI tools sit outside approved architecture, security teams lose the ability to map data handling terms, retention behaviour, and training exposure. That is a governance failure as much as a monitoring failure. The practitioner lesson is to inventory AI tools with the same discipline used for privileged systems and third-party access.

Agentic AI turns DLP into a non-human identity governance issue: once an AI agent can query data stores and synthesize outputs on behalf of a user, the organisation is no longer governing only human intent. It is governing delegated machine action. That requires explicit controls for agent permissions, data scope, and output routing before the agent becomes a standing data path.

AI data loss prevention will converge with identity governance: the article describes a future where source classification, approved tool inventory, and agent permissions must be managed together. That is exactly where IAM, PAM, and NHI programmes become relevant to a data-security problem. Teams that keep these disciplines separate will keep missing the submission point.

From our research library:

• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
• Internal repositories are 6x more likely to contain secrets than public ones (32.2% vs 5.6%), contradicting the assumption that private repos are safe, according to the State of Secrets Sprawl 2026.
• Read next: AI Security Platform Buyer's Guide

What this signals

AI data security is becoming a governance problem, not just a DLP tuning problem: security teams now need to manage where data is allowed to go, which AI tools can receive it, and whether those tools retain or train on submitted content. That makes AI tool inventory and policy enforcement part of the same control conversation.

Agentic workflows widen the identity surface of data protection: once a non-human actor can retrieve, transform, and export information, the organisation needs lifecycle controls for AI permissions as well as content controls for prompts. That is where NHI governance starts to overlap directly with data security.

Shadow AI creates unmanaged submission paths that conventional perimeter controls cannot see: the practical response is to govern AI usage at the point of interaction, then tie those interactions back to source classification and approved destination policies.

For practitioners

• Map GenAI egress paths to data classes Identify where sensitive information can leave controlled repositories through prompts, browser assistants, copilots, and automated agent workflows, then bind those paths to data classification policy.
• Build an AI tool inventory with handling terms Maintain a live catalogue of approved AI tools, whether they train on submitted content, and where they store prompts or outputs so policy can distinguish acceptable from prohibited destinations.
• Enforce endpoint-level submission controls Monitor copy, paste, and browser submission events at the endpoint so controls can see data leaving the source document before it reaches an AI interface.
• Extend governance to agentic workflows Treat AI agents as delegated non-human actors and define what data they may access, summarise, or export across connected systems.

Key takeaways

• Legacy DLP misses GenAI risk because sensitive data now moves through prompts, copilots, and agentic workflows that do not resemble traditional file transfer.
• The governance gap is not only content inspection, but provenance, destination policy, and tool inventory.
• Security teams need controls that follow data into AI tools and extend to non-human actors using delegated access.

Key terms

• Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.
• Prompt Submission Control: Prompt submission control is the enforcement point that determines what data may be entered into an AI tool and under what conditions. It combines source context, destination risk, and user policy so organisations can restrict sensitive submissions without blocking all AI use.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security. It helps security and identity practitioners connect data-flow risk to delegated access, lifecycle control, and policy enforcement.