Notifications
Clear all
Topic starter
09/06/2026 11:19 pm
TL;DR: Browser-session data loss is shifting into unsanctioned AI tools and personal accounts, with Push Security citing Verizon data that 67% of GenAI users on corporate devices access AI tools through non-corporate accounts and its own telemetry showing 37% of AI-tool uploads come from shadow accounts. The real gap is browser-level visibility into what gets uploaded, pasted, or downloaded before endpoint and network controls can see it.
NHIMG editorial — what this means for NHI practitioners
By the numbers:
- 67% of GenAI users on corporate devices are accessing AI tools through non-corporate accounts.
- 37% of file uploads to AI tools come from shadow accounts rather than approved organizational ones.
- 89-category framework spanning personal file sharing, unapproved AI tools, adult content, gambling, and more.
Questions worth separating out
Q: How should security teams control sensitive data going into unsanctioned AI tools?
A: Security teams should enforce policy at the browser session, where uploads, clipboard actions, and downloads actually occur.
Q: Why do personal AI accounts create more risk than sanctioned ones?
A: Personal AI accounts weaken governance because they sit outside organisational control for MFA, retention, monitoring, and revocation.
Q: What do security teams get wrong about browser-based data leakage?
A: They often assume the signal appears in endpoint logs or network security tools.
Practitioner guidance
- Instrument browser-session telemetry for sensitive transfers Track uploads, downloads, copy, and paste actions where data may leave managed systems and land in unsanctioned AI tools or personal accounts.
- Classify AI destinations by risk category Group apps and domains into policy categories such as unapproved AI tools, personal file sharing, and other high-risk destinations so controls can be applied consistently.
- Treat unmanaged accounts as a governance exception Flag AI-tool interactions that occur through shadow accounts or non-corporate identities and route them for review.
What's in the full announcement
Push Security's full post covers the operational detail this post intentionally leaves for the source:
- File upload and download control logic scoped by browser profile, file type, file name, and destination
- Clipboard monitoring rules that flag sensitive content such as API keys, personal access tokens, and PII
- How browser events are forwarded into Microsoft Sentinel, Splunk Cloud, Datadog, Panther, Cribl Cloud, or webhook-connected SIEMs
- The privacy-preserving defaults around personal browsing, credential handling, and clipboard redaction
👉 Read Push Security's analysis of browser controls for AI data leakage →
AI data leakage in the browser session: are controls keeping up?
Explore further
10/06/2026 1:35 am
Browser-session leakage is now an identity governance problem, not just a data-loss problem. The article shows that the same person can remain authenticated to corporate systems while moving sensitive material into an unmanaged AI session. That means governance has to account for where identity authority ends and where ungoverned browser behaviour begins. Practitioners should treat the session as a governance boundary, not just a transport layer.
A few things that frame the scale:
- 67% of GenAI users on corporate devices are accessing AI tools through non-corporate accounts, according to The 2024 State of Secrets Management Survey.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.
A question worth separating out:
Q: How should organisations decide between monitor, warn, and block modes?
A: Use monitor for low-confidence discovery, warn for behaviours that are allowed only with user awareness, and block when the transfer crosses into clearly unsanctioned destinations or regulated data classes. The decision should be based on data sensitivity, account governance, and whether the organisation can accept the exposure if the action completes.
👉 Read our full editorial: Browser-layer controls for AI data leakage in unsanctioned tools
