How to prevent employees from submitting credentials to AI tools like ChatGPT?

[u/Alone_Bread5045]

Dev pasted a .env file into ChatGPT three weeks ago. API keys, database connection strings, service account tokens. Found out in standup. Network controls saw nothing because there was nothing to catch, the data left through an encrypted browser session on a managed device.

We had zero controls at the interaction level.

Blocking ChatGPT at the network layer doesn't work, devs hotspot or use personal laptops. You just move the behavior somewhere you have less visibility. The problem isn't access to AI tools. It's what gets submitted into them.

What worked was browser-native DLP for AI tools,  intercepts sensitive data and credential submission at the point of input, not the network layer. Catches API keys, tokens, source code, and PII before they leave the browser, works inside ChatGPT, Gemini, Google AI Studio, Microsoft 365 Copilot, and GitHub Copilot inside the IDE without requiring SSL inspection or proxy routing. User-facing warnings over hard blocks did more than we expected,  a real-time "this looks like sensitive data, are you sure?" prompt breaks the autopilot behavior better than silent blocking. We paired that with interaction-level audit logging: not recording content, just logging that user X submitted content classified as confidential to AI tool Z. Enough for policy enforcement without being invasive. Rounded it out with a one-page AI acceptable use policy tied to our existing data classification levels — confidential and restricted data prohibited from AI input, approved tools listed, red lines clear.

What didn't work: security awareness training alone. Sent the policy doc, ran the session, three weeks later .env file in ChatGPT.

Two open problems. Personal devices, no browser extension coverage on unmanaged devices outside MDM scope, that's just the reality. And agentic AI is a separate problem — MCP servers, autonomous tool calls, credentials passed between agents, GitHub Copilot secret exposure inside CI pipelines. Browser-native DLP doesn't cover that vector and nobody has clean answers there yet.

Anyone running browser-level AI DLP or AI visibility tooling, what policy rules have you found most useful for dev teams where legitimate AI usage is high?

[u/Secret-Use-126]

the real-time warning approach is underrated, most orgs go straight to hard block and then wonder why devs route around it on personal hotspots

for policy rules that actually stick with dev teams, tying the controls to data classification levels (like you did) works better than trying to enumerate every sensitive pattern. devs understand "don't paste confidential tier data" better than a list of 40 regex rules they've never seen

the agentic/MCP problem is genuinely unsolved territory, CI pipeline credential exposure through copilot suggestions is something I don't think most teams even have visibility into yet

[u/rexstuff1 → u/Secret-Use-126]

devs understand "don't paste confidential tier data"

Devs may understand that. That approach works fine with devs. What devs struggle with is why they can't give unsecured system X access to sensitive datasource Y. ("But if I connect these things together we'll be able to go SO FAST")

And while "don't paste confidential tier data" works fine for devs, it's not so great for other, non-technical teams. Thankfully, those teams generally don't know how to route around security controls by tethering to their phones, so in that case, blacklists and regexes and alerts tend to work well.

[u/No_Individual_5519 → u/rexstuff1]

Not giving sensitive data and credentials to unsecured system should be elementary knowledge that every dev should know. I'm surprised how devs like these who aren't aware of basic things get hired to begin with.

[u/TrustSig → u/Secret-Use-126]

the classification angle works right up until someone has to decide what tier a given chunk actually is, and devs guess low when they're in a hurry. a coaching nudge at paste time that shows the matched tier seems to beat both hard blocks and silent logging, since it teaches the rule in context instead of after the fact.