An employee pastes a few paragraphs of proprietary code into a public chatbot. Another asks an AI assistant to summarize next quarter's financial forecast. Someone uploads a customer contract to compare it against a new agreement.
Security leaders know this happens all the time, and the instinctive reaction is, "We have an AI problem." That's why much of the industry's attention is focused on making AI systems safer: defending against jailbreaks, testing for prompt injection, and hardening models against adversarial attacks.
That work matters, but it risks overlooking the bigger problem. In the incidents described above, the AI wasn't the issue. The models were doing exactly what they were designed to do. The problem was that employees gave them sensitive company data they should never have received.
But most companies don’t have visibility into this kind of data movement to AI. According to Software Analyst Cyber Research, an independent research firm, three out of four enterprises have adopted AI, but just 7% report they have real-time governance in place.
AI Agents Change the Equation
Enter an even bigger risk: AI agents. They fundamentally change the enterprise threat model because unlike a chat bot, they don't just answer questions. They're designed to retrieve documents, invoke tools, connect to enterprise applications, and move data on a user's behalf.
This gives attackers a new path to an organization's crown jewels without breaking in. Instead of stealing credentials or exploiting a vulnerability, they can manipulate an agent that already has legitimate access to sensitive systems. A hidden instruction buried in an otherwise ordinary document, a poisoned connector, or a malicious tool can convince an agent to retrieve sensitive information from multiple enterprise applications and send it somewhere it doesn't belong, all while the agent is carrying out what appears to be a legitimate workflow.
However, an attacker isn't always necessary. Agents inherit the permissions they're given, and those permissions are often broader than any single task requires. An agent asked to draft a customer update might also have standing access to unreleased financials, HR records, or internal pricing — not because the task needs them, but because no one scoped its access down. In that case, the agent doesn't have to be tricked into leaking data; it can expose it simply by doing exactly what it was asked to do, the same way an over-permissioned employee might forward a sensitive file they technically had access to but never should have touched.
The blast radius for AI agents is dramatically different from anything security teams have managed before. A person might spend hours searching SharePoint, GitHub, Slack, Salesforce, and internal knowledge bases to answer a question. An AI agent can do the same work in seconds, connecting information across systems and moving it automatically. Every connector expands what the agent can access, and every new connection creates another path sensitive data can take out of the enterprise.
AI Isn't the Enemy
None of this means organizations should slow AI adoption. AI is quickly becoming the productivity layer of the enterprise, helping employees write code faster, analyze contracts, summarize research, and automate work that once took hours. Security leaders who treat AI as something to contain are fighting the wrong battle.
The challenge is that the security tools protecting enterprise data were built for a different era. Legacy data loss prevention assumes data moves through predictable channels like email, file transfers, and web uploads, where users manually move information between systems.
AI agents don't work that way. They invoke APIs, chain together trusted tools, and move data across enterprise applications as part of legitimate workflows. From the perspective of traditional DLP, nothing looks suspicious until sensitive information has already left the organization.
Security leaders should be rethinking data protection around how information moves, in real time and in context, regardless of whether it's an employee or an AI agent moving it.
How to Build an AI-Ready DLP Program
That shift starts with a few practical changes.
Start with visibility, not policy. Before writing a single rule, understand what sensitive data is actually flowing into AI tools and agents across your organization, including sanctioned and unsanctioned tools. You can't govern what you can't see.
Replace blanket blocking with intelligent guardrails. Monitor routine activity without adding friction. Warn users when they're about to expose sensitive information, automatically redact high-risk content before it leaves the environment, and reserve hard blocks for the data movement which would cause real business damage if it left the organization: source code, financial forecasts, legal documents, regulated data, and intellectual property.
Govern AI agents like digital employees. Apply least-privilege access, identity and access controls, continuous logging, and behavioral monitoring. As agents gain the ability to retrieve information, invoke tools, and move data across multiple enterprise systems, organizations should be able to see not just that an agent exists, but what it accessed, which tools it invoked, what systems it connected to, and whether the data movement was appropriate.
Build your program around movement and context. Static classification isn't enough in an AI-driven enterprise. Governance and DLP systems should continuously track how sensitive data moves, who accessed it, where it went, and why, creating the visibility and audit trail needed to reduce risk without slowing productivity.
Employees won't stop using AI. AI agents will only become more capable. Organizations that succeed won't be the ones trying to force work back into yesterday's security model. They'll be the ones that embrace AI while building security around how data actually moves through it.
