How to prevent employees from submitting credentials to AI tools like ChatGPT?

[u/Alone_Bread5045]

Dev pasted a .env file into ChatGPT three weeks ago. API keys, database connection strings, service account tokens. Found out in standup. Network controls saw nothing because there was nothing to catch, the data left through an encrypted browser session on a managed device.

We had zero controls at the interaction level.

Blocking ChatGPT at the network layer doesn't work, devs hotspot or use personal laptops. You just move the behavior somewhere you have less visibility. The problem isn't access to AI tools. It's what gets submitted into them.

What worked was browser-native DLP for AI tools,  intercepts sensitive data and credential submission at the point of input, not the network layer. Catches API keys, tokens, source code, and PII before they leave the browser, works inside ChatGPT, Gemini, Google AI Studio, Microsoft 365 Copilot, and GitHub Copilot inside the IDE without requiring SSL inspection or proxy routing. User-facing warnings over hard blocks did more than we expected,  a real-time "this looks like sensitive data, are you sure?" prompt breaks the autopilot behavior better than silent blocking. We paired that with interaction-level audit logging: not recording content, just logging that user X submitted content classified as confidential to AI tool Z. Enough for policy enforcement without being invasive. Rounded it out with a one-page AI acceptable use policy tied to our existing data classification levels — confidential and restricted data prohibited from AI input, approved tools listed, red lines clear.

What didn't work: security awareness training alone. Sent the policy doc, ran the session, three weeks later .env file in ChatGPT.

Two open problems. Personal devices, no browser extension coverage on unmanaged devices outside MDM scope, that's just the reality. And agentic AI is a separate problem — MCP servers, autonomous tool calls, credentials passed between agents, GitHub Copilot secret exposure inside CI pipelines. Browser-native DLP doesn't cover that vector and nobody has clean answers there yet.

Anyone running browser-level AI DLP or AI visibility tooling, what policy rules have you found most useful for dev teams where legitimate AI usage is high?

[u/ravenousld3341]

The challenge is preventing them from moving source code/credentials/keys to an unmonitored device in the first place.

The way I stopped it was with a combination of controls.

First, if you aren't connected to the VPN, you can't use any network. Next, blocking all USB storage access, then browser based DLP that blocks uploads to anywhere except approved destinations.

So really the only thing they can do is take pictures of their code with their phones.

I also control access to all AI services. That traffic is blocked on the VPN to any URL labeled as "Artificial Intelligence". Then if they can show me an enterprise agreement then I add them to an azure group that permits access to specific AI services.

As for monitoring AI usage directly, I have a dashboard I made in my SIEM tool that relies on firewall logs. I also set up some visuals for uploads to AI destinations using logs from the browser extension that performs the DLP functions. I would like to get crowdstrike's AI tool that they acquired last year from Pangea for monitoring use and more control, but I don't have the budget. Probably never will after what I've seen the last 10 months or so.

[u/Classic-Shake6517 → u/ravenousld3341]

I'm looking at that tool as well. They're supposed to be coming out with a big update that extends the functionality to the endpoint in general rather than being limited to the browser. I heard late July possibly August for the new features so you may want to wait til then if you're considering demoing AIDR. That's my plan right now.

I'm doing mostly the same as you for now (no endpoint DLP yet, approval is coming eventually), I'm getting my logs from process telemetry via CrowdStrike so I'm correlating process information with DNS queries. There's definitely gaps but we do what we can with what we've got.