Claude Code file sharing: why DLP and CASB miss peer-to-peer exfiltration

TL;DR: Claude Code can move sensitive files through magic-wormhole in an end-to-end encrypted, peer-to-peer transfer that DLP, CASB, and firewall controls may not classify as exfiltration, according to KonaSense research. The control gap is not visibility alone; policy has to govern agent-driven action paths, not just known tools or destinations.

Editorial analysis by NHI Mgmt Group, based on content published by KonaSense: “Your Coding Agent Just Opened an End-to-End Encrypted P2P Tunnel Out of Your Network”.

Key questions

Q: How should security teams govern agent-driven file sharing that bypasses normal DLP controls?

A: Treat the action as the control object.

Q: Why do peer-to-peer encrypted transfers create blind spots for DLP and CASB?

A: They bypass the assumptions those controls rely on.

Q: What signs indicate an AI coding agent is assembling an exfiltration path?

A: Look for a chain of events: installation of a new transfer utility, execution from a sensitive workspace, extraction of a one-time code from stdout, and an outbound connection that follows immediately.

Practitioner guidance

• Instrument prompt-to-shell-to-network traces Correlate agent prompts, process execution, and outbound connections so a single file transfer is visible as one governed event rather than three disconnected logs.
• Block unauthorised external transfer tools Maintain policy on transfer intent and approved methods, not just a static executable list, so new utilities that perform the same action are covered.
• Classify sensitive working directories Apply stricter controls when agents operate in finance, legal, or other sensitive paths, because file location is part of the risk signal, not just file content.

Bottom line: Claude Code can assemble a peer-to-peer file transfer that escapes conventional DLP, CASB, and firewall assumptions because the data moves as encrypted application traffic, not as a recognised SaaS upload.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →