It is an employee doing their job, and sending the wrong content through an AI tool. No attacker, no malware, no dramatic breach. Just ordinary work, moving faster than the guardrails, which in most small and medium businesses do not exist yet.
Security stories usually have a villain. This category does not, and that is exactly what makes it hard to manage. The people involved are your best people, using tools that genuinely make them faster, in ways that feel completely harmless in the moment. Understanding how that turns into an incident is the first step to preventing one.
Three ordinary moments
Watch how it actually happens, because none of it looks like a security event.
A developer hits a stubborn bug at 4pm and pastes the function into a coding assistant to get unstuck. The function works now. The API key that was sitting in the snippet is also now outside the company.
An analyst gets asked for a summary of compensation trends before tomorrow's meeting. Uploading the spreadsheet to an AI tool turns an evening of work into ten minutes. The spreadsheet was the salary file, and it just left through a personal account.
A manager needs to draft a delicate message about an upcoming reorganization. The AI drafts it beautifully. To get that draft, the manager first had to explain the reorganization, in plain English, to a tool the company has never reviewed.
Nobody in these stories did anything unusual. They used the tools exactly as designed. That is the defining feature of this risk: the incident and the productivity are the same action.
What actually leaks
Across the research, five categories of data leave through AI tools most often, and they map uncomfortably well to the things a business least wants outside its walls:
Source code. Functions, files, sometimes whole repositories, pasted into coding assistants. Often with credentials embedded.
Credentials and API keys. Rarely shared on purpose. They ride along inside debug snippets, config files, and log excerpts.
Financial data. Revenue, forecasts, salaries, deal terms, uploaded for summarizing, modeling, or drafting.
Strategic content. Roadmaps, restructuring plans, negotiations, board material, shared as context so the AI can write about them.
Customer data. Names, contacts, transactions, support histories, pasted in to draft replies or analyze accounts.
The scale is documented and not small. Zscaler tied 410 million data-loss-prevention violations to ChatGPT alone, including Social Security numbers, source code, and medical records. Netskope found the average organization logs 223 incidents per month of sensitive data heading into AI apps, a figure that more than doubled year over year. Cyberhaven measured the human rhythm of it: the average employee sends sensitive data into an AI tool about once every three days. The full statistics roundup is here.
The three doors it leaves through
Part of why this slips past existing controls is that there is not one leak path. There are three, and they behave differently.
Typed and pasted prompts. The text an employee writes or pastes into the chat box. This is where meaning leaks: a merger described in plain English has no pattern for a traditional filter to match.
File uploads. Documents, spreadsheets, images, code files, handed over whole. One upload can carry thousands of records.
Paste events. Content copied from another application, a CRM record, an email thread, a contract, and dropped into the AI as context.
A control that only watches one of these misses the other two. And because all three happen inside encrypted sessions in tools that look legitimate to a firewall, network-level security sees nothing unusual at all.
Why "we already have DLP" usually is not the answer
Traditional data-loss prevention was built to recognize patterns: card numbers, Social Security numbers, file types. It is genuinely useful for those. But look back at the five categories above. A strategy paragraph, a client situation described conversationally, a forecast summarized in a sentence: these leak as meaning, not as patterns. Legacy tools can see which app was opened. They cannot see what was typed into it, and the prompt is where this entire risk lives.
That is why a new category of AI-aware protection has emerged, built around the interaction itself rather than the network. The capability worth understanding is real-time detection at the prompt level, with responses more nuanced than allow-or-block: the sensitive fragment, say a credential inside a code snippet, gets masked automatically while the rest of the prompt goes through. The developer still gets unstuck. The key stays home. Work continues, and there was no incident.
That nuance matters for adoption, because the blunt alternative, blocking everything, teaches employees to route around security. Guardrails that preserve productivity are the ones people actually live with.
What a small or medium business should take from this
First, retire the mental model of the AI incident as an attack. The most likely version in your business looks like a helpful employee and a deadline. Plan for that, not for a villain.
Second, know your three doors. Prompts, uploads, and pastes each need an answer, even if the answer for now is just awareness and a written policy that names them.
Third, be honest about what your current tools can see. If the answer to "what did our employees put into AI tools last month" is a shrug, the exposure is unmeasured, and unmeasured has a way of meaning bigger than expected. IBM's 2025 numbers give the stakes: breaches involving shadow AI ran about $670,000 above the average, and 63% of organizations still have no AI policy at all.
None of this is a reason to slow down on AI. It is a reason to add the guardrails the tools did not come with. Adding exactly those guardrails is what our Managed AI Security service does, starting with a free Shadow AI Discovery that shows you what is actually in use. Prefer to talk it through first? We are happy to have that conversation.
cAIberOps is a managed security service provider based in McLean, Virginia. We secure the AI your team already uses, nationwide, and protect small and medium businesses with managed email security and managed endpoint protection.
