AI data leakage is sensitive information leaving an organization's control because someone pasted it into a public AI tool — not through a hack, but through ordinary, well-intentioned use of ChatGPT, Claude, Gemini, or Copilot.
How it typically happens
- A developer pastes a stack trace or config file into ChatGPT to debug an error — and the config contains a database password or API key.
- A support agent copies a customer's name, email, and account details into an AI tool to draft a response.
- Finance uploads a spreadsheet with salary or account data to "summarize it quickly."
- An employee uploads an internal strategy document or contract to an AI tool to get a summary.
None of these are malicious. That's what makes AI data leakage different from a traditional breach — the person doing it usually doesn't realize it's a problem.
Why it's a growing risk
AI tools are now part of how people get everyday work done, often without IT ever approving or even knowing about it — commonly called "shadow AI." Unlike an approved SaaS tool, there's usually no contract governing what happens to the data, and no visibility into what was shared.
How organizations reduce it
The most direct approach is inspecting prompts and file uploads before they reach the AI tool — an AI DLP agent running on the device can catch credentials, PII, and custom-flagged content and block, warn, or redact it in real time. See What is AI DLP? or how to prevent it in practice.