Topic starter
20/08/2026 5:40 pm
TL;DR: Sensitive data can reach LLMs through prompts, files, APIs, browser sessions, and MCP-connected agents, so prompt filtering alone no longer protects PII, PHI, PCI data, credentials, or customer records, according to Strac. The governance problem is data boundary control, not simply restricting AI usage.
Editorial analysis by NHI Mgmt Group, based on content published by Strac: “How to NOT Pass Customer PII or PHI in OpenAI LLM?”.
By the numbers:
- Around 15% workers pass sensitive data to ChatGPT inadvertently.
Key questions
A: The first step is to inventory the agent’s permissions and compare them with its actual tasks, then remove any standing access that is not required.
Q: Why do AI agents and MCP-connected workflows create new data exposure risks?
A: AI agents and MCP-connected workflows expand access beyond human users into systems that can retrieve, transform, and move sensitive data automatically.
Q: What are the signs that AI training controls for private data are failing?
A: Common warning signs include unclear privacy notices, rapid policy revisions without plain-language explanation, default-on sharing settings, and inability to state confidently which content is excluded from model training.
Practitioner guidance
- Define approved AI data classes Classify which data types an LLM, application, or agent may see, including PII, PHI, PCI data, credentials, and customer records, then map those classes to explicit allow or deny rules.
- Place controls at retrieval time Apply redaction, masking, tokenisation, or blocking before an agent can pass enterprise data into the model, rather than relying on users to self-censor prompts.
- Review agent retrieval entitlements Audit which non-human identities, service accounts, or connected integrations can query SaaS tools and internal systems, and remove access that is not needed for the AI task.
Bottom line: MCP-connected workflows widen the exposure surface because AI agents can retrieve sensitive records directly from enterprise systems, not just from user prompts.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:24 pm
Data boundary control is now the governing problem in AI risk. The article shows that the sensitive-data question is no longer limited to whether a user types protected information into ChatGPT. Once agents can retrieve data directly from connected systems, governance has to control transfer boundaries, not just user behaviour. Practitioners should treat AI data movement as a policy enforcement problem across systems, not as a prompt-safety problem.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should organisations govern AI agents that need database access?
A: Organisations should give AI agents narrow read access by default, separate write privileges from query privileges, and require human approval for any session that can modify data. That keeps agent activity inside a clearly bounded role while preserving auditability and reducing the chance of unsupervised state change.
👉 Read our full editorial: MCP-connected AI workflows expand sensitive-data exposure paths