Shadow AI data leaks expose the limits of traditional DLP

At a glance

What this is: Strac argues that shadow AI creates invisible data-leak paths because employees can move sensitive information into GenAI tools without the file-transfer events traditional DLP expects.

Why it matters: This matters because IAM, data security, and AI governance teams need controls that inspect prompts, browser activity, and third-party connections, not just email and endpoint exfiltration.

Context

Shadow AI is a governance problem before it is a tooling problem. Employees are now using GenAI systems inside ordinary workflows, often with direct access to company data through OAuth and SaaS integrations, so leakage can occur without the classic signals that DLP and SOC teams are tuned to watch.

The identity angle is material because these connections are often granted to applications, agents, and browser tools that act like non-human identities in practice. Once those integrations can read mail, files, or CRM records, the question shifts from whether data can leave the environment to whether the organisation can govern who or what is authorised to move it.

Key questions

Q: What breaks when shadow AI is not part of the asset inventory?

A: When shadow AI is absent from inventory, security teams cannot apply policy, logging, access review, or remediation to the workload. That means the service may process sensitive data and expose credentials without ever entering the governance process, which turns discovery into a control boundary, not just a reporting issue.

Q: Why do OAuth-connected AI apps create hidden data exposure risk?

A: OAuth-connected AI apps can hold broad, persistent permissions that outlive the employee’s immediate use of the tool. That turns a quick signup into a standing delegated access path. The risk grows when users or admins approve read, write, or offline scopes without a lifecycle process for ownership, review, and revocation.

Q: How can security teams reduce prompt-based data leaks?

A: Use inline controls that inspect prompts and file uploads before they reach external models, then redact or block sensitive content when policy thresholds are met. This is more effective than relying on downstream review because the disclosure happens at the moment of submission. The control must sit in the interaction path.

Q: Should organisations prioritise AI governance before expanding DLP to browser-based workflows?

A: Yes, because browser activity is now one of the main paths for sensitive data entering GenAI tools. Organisations should define approved tools, allowed data types, prohibited uploads, and remediation rules before broad rollout. Browser DLP and AI governance together help stop prompt leakage and risky uploads while still supporting legitimate AI use.

Technical breakdown

Why traditional DLP misses shadow AI prompts

Traditional data loss prevention was built around observable transfer events such as email attachments, file uploads, downloads, and network egress. Shadow AI breaks that model because the sensitive content is often entered directly into a browser prompt or passed through a connected SaaS app, where it looks like normal user activity. The control issue is not only inspection depth. It is that the policy enforcement point sits too late, after a human has already translated the data into a prompt or an API call. In identity terms, the system is relying on a user session boundary that no longer reflects how data actually moves.

Practical implication: Inspect prompts and browser-based AI usage before content reaches external models, not just after files leave the network.

How OAuth connections expand AI data exposure

Many AI tools do not need a malware-style compromise to create risk. They inherit access through OAuth grants and SaaS integrations, which lets them query mailboxes, files, calendars, tickets, or code repositories once authorised. That makes the AI tool an identity-bearing integration point, not just a passive application. If the grant is broad, unmanaged, or invisible to security teams, the tool can aggregate data across systems faster than manual review can detect. The governance problem is entitlement scope, lifecycle, and revocation, especially when the connected app is outside standard approval paths.

Practical implication: Review and constrain OAuth grants for AI apps with the same discipline used for privileged third-party access.

Why GenAI data protection has to be real time

Real-time protection matters because the sensitive event happens at the moment of prompt submission, not when the output is later stored or shared. Once a model receives a customer list, source code snippet, or internal strategy note, the exposure already exists even if the final response is never exported. That is why redaction, blocking, and risk scoring must operate inline. In practice, this is a boundary-control problem: the organisation needs to stop sensitive context at the point of disclosure, while still allowing approved AI use for low-risk tasks.

Practical implication: Move DLP decisions to the interaction layer so sensitive data is redacted or blocked before the model receives it.

Threat narrative

Attacker objective: The objective is to extract sensitive business data through normal-looking AI use rather than through overt malware or file exfiltration.

1. Entry occurs when an employee or business user pastes sensitive content into a GenAI prompt or authorises an AI app through OAuth-connected SaaS access.
2. Credential or entitlement abuse follows when the connected AI tool inherits access to mail, files, CRM records, or shared documents across internal systems.
3. Impact occurs when the model output, prompt content, or connected integration exposes customer data, source code, or internal strategy outside the organisation.

Breaches seen in the wild

• Samsung ChatGPT leak 2023: Samsung staff pasted chip source code and meeting notes into ChatGPT weeks after it was allowed, leading Samsung to restrict generative AI tools.
• Vercel Context.ai OAuth Supply Chain Breach: Shadow AI app Context.ai OAuth integration exposes Vercel customer data via unmanaged third-party token.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Shadow AI is a data-governance failure disguised as a productivity issue: once employees can move sensitive content into GenAI tools through prompts and browser-based workflows, classic DLP becomes a partial control at best. The problem is not only visibility. It is that the policy boundary no longer matches the data movement boundary. Practitioners should treat shadow AI as a governance domain that spans data security, IAM, and AI usage policy.

OAuth-granted AI apps create a new class of non-human access risk: these tools are not merely software clients, they are delegated actors with inherited access to enterprise data. That makes entitlement review, approval scope, and offboarding a core part of AI governance. The control gap is familiar to IAM teams, but the AI wrapper makes it easier to miss because the data exposure often appears as ordinary collaboration.

Prompt-layer inspection is becoming the decisive control point: if security only watches downloads, uploads, and email, it will miss the most common shadow AI leakage path. Real protection now depends on inspecting content before it reaches the model, then constraining what connected tools can read in the first place. That shifts the emphasis from downstream detection to upstream authorisation and enforcement.

Shadow AI discovery should be treated as an identity inventory problem: organisations cannot govern what they have not discovered, and unmanaged AI apps behave like unsanctioned service accounts with broad data reach. Discovery, approval, and revocation need to be tied together. The practical conclusion is that AI governance without access governance will remain incomplete.

Named concept, prompt-boundary governance: the real control gap is the failure to enforce policy at the moment data becomes a prompt. Traditional DLP assumes the leakage event is a transfer. In GenAI environments, the disclosure event is the interaction itself, so governance must move to the prompt boundary before content leaves the environment.

From our research library:

• 63% of organisations surveyed lacked AI governance policies to manage AI or prevent shadow AI, according to IBM's 2025 Cost of a Data Breach Report.
• Read next: Shadow AI and AI Agent Discovery Guide

What this signals

Prompt-boundary governance: the control point for shadow AI is moving from file and network inspection to the moment a user discloses content to a model. That requires coordinated policy across DLP, identity, and AI access governance so the organisation can intervene before data becomes model input.

The next maturity step is not broader logging. It is a tighter link between discovery, delegated access review, and prompt enforcement, because unmanaged AI apps behave like high-reach integrations even when they present as ordinary productivity tools.

For practitioners

• Map shadow AI as an access inventory problem Build a live inventory of approved and unapproved AI apps, browser extensions, and SaaS integrations that can reach enterprise data. Include who authorised them, what data they can access, and when the grant was last reviewed.
• Constrain OAuth grants for AI integrations Review delegated permissions for mail, file, chat, CRM, and code systems, then remove broad scopes that are not required for the task. Revalidate grants whenever the AI app changes function or ownership.
• Inspect prompts before model submission Apply inline redaction or blocking when prompts contain customer PII, source code, secrets, or internal strategy. Put enforcement in the browser or gateway path so sensitive data is stopped before an external model receives it.
• Tie AI app offboarding to identity lifecycle When an AI tool is removed, ensure its OAuth tokens, API keys, and connected permissions are revoked, not just disabled in a front-end policy list. Treat shadow AI as part of account lifecycle control.
• Prioritise high-risk AI workflows first Focus on workflows that touch customer records, source code, finance data, or regulated personal information before broader productivity use cases. That sequencing gives the fastest reduction in exposure with the least operational friction.

Key takeaways

• Shadow AI creates a leakage path that traditional DLP often misses because the sensitive event occurs inside prompts and browser interactions, not only in file transfer.
• OAuth-connected AI apps can inherit access to enterprise systems and expand exposure across mail, files, CRM records, and code repositories.
• Real-time prompt inspection, delegated access review, and lifecycle revocation are the controls that matter most when employees use GenAI tools with company data.

Key terms

• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• GenAI DLP: GenAI DLP applies data-loss prevention controls to prompts, uploads, and outputs in AI tools. It treats interactions with LLM-based systems as data transfer events, which allows teams to detect, block, or warn when regulated content or secrets are being shared.
• OAuth Grant: An OAuth grant is the delegated permission an application receives to act on a user's behalf without storing the user's password. In NHI governance, it should be treated as a standing identity relationship with scope, ownership, and revocation requirements, not as a one-time setup detail.
• Prompt-Boundary Governance: Prompt-boundary governance is the control discipline that manages what a user may disclose to an AI system at the moment of interaction. It combines identity, content sensitivity, and policy enforcement so the organisation can prevent risky data from entering external model workflows in the first place.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, IAM, and secrets management. It helps security practitioners connect identity control to the data and access risks that shadow AI introduces.