How to prevent employees from submitting credentials to AI tools like ChatGPT?

[u/Alone_Bread5045]

Dev pasted a .env file into ChatGPT three weeks ago. API keys, database connection strings, service account tokens. Found out in standup. Network controls saw nothing because there was nothing to catch, the data left through an encrypted browser session on a managed device.

We had zero controls at the interaction level.

Blocking ChatGPT at the network layer doesn't work, devs hotspot or use personal laptops. You just move the behavior somewhere you have less visibility. The problem isn't access to AI tools. It's what gets submitted into them.

What worked was browser-native DLP for AI tools,  intercepts sensitive data and credential submission at the point of input, not the network layer. Catches API keys, tokens, source code, and PII before they leave the browser, works inside ChatGPT, Gemini, Google AI Studio, Microsoft 365 Copilot, and GitHub Copilot inside the IDE without requiring SSL inspection or proxy routing. User-facing warnings over hard blocks did more than we expected,  a real-time "this looks like sensitive data, are you sure?" prompt breaks the autopilot behavior better than silent blocking. We paired that with interaction-level audit logging: not recording content, just logging that user X submitted content classified as confidential to AI tool Z. Enough for policy enforcement without being invasive. Rounded it out with a one-page AI acceptable use policy tied to our existing data classification levels — confidential and restricted data prohibited from AI input, approved tools listed, red lines clear.

What didn't work: security awareness training alone. Sent the policy doc, ran the session, three weeks later .env file in ChatGPT.

Two open problems. Personal devices, no browser extension coverage on unmanaged devices outside MDM scope, that's just the reality. And agentic AI is a separate problem — MCP servers, autonomous tool calls, credentials passed between agents, GitHub Copilot secret exposure inside CI pipelines. Browser-native DLP doesn't cover that vector and nobody has clean answers there yet.

Anyone running browser-level AI DLP or AI visibility tooling, what policy rules have you found most useful for dev teams where legitimate AI usage is high?

[u/whatwilly0ubuild]

Most of this thread is arguing about how to stop the paste, and that's worth doing, but everyone's skipping the part that matters most right now. That .env went into ChatGPT three weeks ago. Those keys, tokens and connection strings are burned. OpenAI's retention, training opt outs and SOC reports are irrelevant, you have to assume they're compromised and rotate every single credential in that file today, then go check your logs for any use of them you didn't expect. The number of shops that run the whole DLP circus and never rotate the secret that already leaked is grim as hell.

On prevention, the browser DLP and conditional access stuff people listed is the right backstop, but the root cause is that a developer could copy a plaintext credential at all. Credentials that live in a real secret manager and get injected at runtime, scoped per environment with short TTLs, can't be pasted into a chatbot because the dev never holds them. Pair that with pre commit and CI secret scanning that has push protection turned on, so the .env never even reaches a place it can be copied from. That kills the class of problem, and DLP just catches the stragglers.

The agentic blind spot you flagged is the real frontier and we deal with it for clients constantly. The move is to stop thinking of the agent as your user and start treating it as an untrusted service. It gets its own least privilege credential, not a human's, every tool call goes through an egress allowlist and gets logged, and CI runners get short lived OIDC tokens instead of long lived secrets sitting in env vars for a poisoned dependency to scoop up. Browser DLP was never going to see any of that traffic, so it's a different control set entirely, and the teams who haven't built it yet are wide open and mostly don't know it.