Is using an AI tool a form of this?

It can be exactly the same action described two ways. Material entering a third-party service is material that has left, and whether that matters depends on the agreement with the vendor, what they retain and what they may use it for, rather than on the act of pasting itself.

What is realistically detectable?

Volume, destination and timing on channels the organisation runs, which catches bulk movement and unusual patterns. Typing into a browser tab is not visible, a personal device is not visible, and a photograph of a screen is outside technical detection entirely.

Does clamping down work?

It reduces the visible version and tends to relocate the rest. Controls tight enough to stop the accidental case also block legitimate work, and the common outcome is that people move to equipment the organisation cannot see, which is a worse position than the one being fixed.

Glossary

Data exfiltration

Company information ending up somewhere it should not be, which now happens through ordinary use of ordinary tools far more often than through anything dramatic.

In plain terms

Papers leaving the building. The picture people hold is somebody carrying a box out at night, and the reality is almost always somebody emailing themselves a file because they wanted to work on it at home, or pasting a document into a tool that helps them write.

Why it matters

Because the deliberate version is rare and the accidental version is constant, and controls designed for the first do very little about the second. Somebody moving material to get their job done leaves the same trace as somebody moving it for a competitor, and the organisation usually cannot tell the difference at the moment it happens, which is the whole difficulty.

How it works

Most of it is ordinary behaviour with an unintended destination. Forwarding to a personal address, uploading to a personal storage account, pasting into a browser tab: each is somebody trying to finish a task, and each moves company material outside anything the organisation controls.

The deliberate version is the rarer case and the one most controls are shaped around. Somebody leaving with a customer list is the story that gets told, and it is genuinely serious, and building only for it means the everyday version continues unremarked because nobody designed for a person acting in good faith.

AI tools blurred the line in a way that is genuinely new. Pasting a contract into an assistant to have it summarised is simultaneously the intended use of the product and material leaving for a third party, and no rule can separate those two descriptions because they are the same action.

What can be detected is narrower than people expect. Volume, unusual destinations and unusual timing are visible on channels the organisation runs; typing into a browser tab on a personal device is not, and a photograph of a screen is not detectable by any technical means at all.

The uncomfortable part is that stopping it and enabling work are the same dial. Every control tight enough to prevent the accidental version also blocks something somebody legitimately needed, which is why organisations that clamp down hard tend to discover the behaviour has moved to equipment they cannot see.

The version built for, and the version that happens

Holding these apart matters because the response to each is different and the second rarely gets one. The left-hand column is what monitoring is tuned for, and monitoring is reasonably good at it: bulk movement to somewhere strange at an odd hour stands out against everything else, and an organisation that catches that has caught something worth catching. The right-hand column produces no anomaly at all, since one person sending one document to one place they find useful is what the day looks like for everybody. The AI category sharpened this because it removed the last bit of friction: the destination now offers something genuinely valuable in return, so the behaviour has a reward attached rather than merely being convenient. What follows is not that controls are pointless but that the right-hand column is a policy and expectations problem rather than a detection one. Detection can tell you about the left column. Only agreement about which tools are acceptable, and vendor terms that make a particular destination safe rather than merely popular, does anything about the right.

Seen in the wild

A contract pasted into an assistant for summarising, which is both the intended use and material leaving.
ChatGPT
A search deployment exposing material through a connector nobody realised reached that far.
Glean
An automation quietly copying records to a destination outside the organisation on a schedule.
Make

Common misconceptions

People assume

It describes theft.

In fact

It describes a destination rather than an intention. Most of it is somebody trying to finish work, and the trace they leave is indistinguishable at the moment it happens from somebody acting deliberately, which is what makes the response difficult.

People assume

Blocking the obvious routes handles it.

In fact

It moves the behaviour rather than removing it. Closing the convenient path leaves the need in place, and the usual result is the same work happening on a personal device where nothing can be seen at all.

Questions

Is using an AI tool a form of this?: It can be exactly the same action described two ways. Material entering a third-party service is material that has left, and whether that matters depends on the agreement with the vendor, what they retain and what they may use it for, rather than on the act of pasting itself.
What is realistically detectable?: Volume, destination and timing on channels the organisation runs, which catches bulk movement and unusual patterns. Typing into a browser tab is not visible, a personal device is not visible, and a photograph of a screen is outside technical detection entirely.
Does clamping down work?: It reduces the visible version and tends to relocate the rest. Controls tight enough to stop the accidental case also block legitimate work, and the common outcome is that people move to equipment the organisation cannot see, which is a worse position than the one being fixed.

Key takeaways

The everyday version is somebody trying to finish work, not theft.
Pasting into an AI tool is one action with two accurate descriptions.
Detection covers channels you run, and little else.
Tightening controls relocates the behaviour more reliably than it stops it.

Tools that use this

ChatGPT
Pasting a contract to summarise is both intended use and material leaving.
Glean
A connector reaching further into material than anybody realised.
Make
Scheduled copying to a destination outside the organisation.

Last checked August 2026

All glossary terms