Notifications
Clear all
Topic starter
20/08/2026 5:40 pm
TL;DR: Sensitive data can reach LLMs through prompts, files, APIs, browser sessions, and MCP-connected agents, so prompt filtering alone no longer protects PII, PHI, PCI data, credentials, or customer records, according to Strac. The governance problem is data boundary control, not simply restricting AI usage.
NHIMG editorial — based on content published by Strac: How to NOT Pass Customer PII or PHI in OpenAI LLM?
By the numbers:
- Around 15% of workers pass sensitive data to ChatGPT inadvertently.
Questions worth separating out
Q: How should security teams govern sensitive data in LLM workflows?
A: Security teams should govern the full data path, not just the model endpoint.
Q: Why do MCP-connected agents increase AI data leakage risk?
A: MCP-connected agents can retrieve data directly from enterprise systems, so sensitive information may enter AI workflows without a person copying it into a prompt.
Q: What is the difference between redaction and tokenization in AI data protection?
A: Redaction removes sensitive content before it reaches the model, while tokenization replaces the value with a surrogate that can sometimes be reversed under controlled conditions.
Practitioner guidance
- Define AI data boundary policies Classify which data types may enter LLM workflows, which must be masked, and which must be blocked entirely before retrieval or prompt submission.
- Apply retrieval controls to MCP connectors Treat each MCP-connected tool as a scoped data access path and enforce least privilege at the connector level, not just at the chat layer.
- Instrument redaction before model submission Place detection, redaction, masking, or tokenization ahead of the LLM so sensitive values are transformed before they can influence the model context.
What's in the full article
Strac's full article covers the operational detail this post intentionally leaves for the source:
- Detection and redaction patterns for sensitive text moving through prompts, files, and API workflows
- Tokenization and masking examples that preserve utility while preventing raw PII or PHI from reaching the model
- MCP DLP controls for connected agents that retrieve data directly from SaaS and internal systems
- Implementation guidance for applying policy before data crosses into an AI workflow
👉 Read Strac's analysis of how to keep PII and PHI out of OpenAI LLM workflows →
MCP and AI data leakage: what security teams need to control?
Explore further
20/08/2026 6:24 pm
Data boundary control has become the real AI governance problem. Organisations have spent too much time assuming the only risk is a user typing sensitive text into a chatbot. The source article shows that AI agents and connected workflows can retrieve data directly from enterprise systems, which means the boundary now sits between source systems, orchestration layers, and the model. Practitioners should treat data egress into AI as a governed decision, not a user etiquette problem.
A question worth separating out:
Q: How can organisations prove their AI controls are actually working?
A: Look for evidence that policy decisions are logged, sensitive prompts are being redacted or blocked when required, and approved AI interactions are traceable by identity and business context. Effective programmes produce audit-ready records, not just policy text. If the control cannot explain what happened in a session, it is not operational enough.
👉 Read our full editorial: MCP-connected AI workflows expand sensitive-data exposure paths
