AI Is Exposing Your Data: An AI Security Problem You Can't See
Jeff Crume explains how AI agents, RAG pipelines, prompts, tools, and models move sensitive data through modern AI systems, and why traditional DLP falls short. He outlines a unified approach built on data lineage, workload and workforce visibility, proactive risk identification, and compliance reporting.
Jeff Crume opens with a pointed question: do you know where your data is? Even if you think you do, he argues, your sensitive data has probably already been exposed, and AI adoption is making the problem worse in ways most teams cannot see. He cites a recent study finding that 31% of organizations had a data privacy violation caused by an AI-related incident.
Where the exposure comes from
- Shadow AI: unauthorized AI projects that employees deploy inside the environment, often without the security controls that policy requires.
- Public cloud chatbots: people paste questions along with spreadsheets of sensitive information. Crume’s warning is that once that data reaches a public chatbot, it effectively becomes public, since it can be used to train models available to everyone.
- Traditional data loss prevention (DLP) and AI tools cannot answer the core questions: what data did the AI use, where did it come from, and how do we manage exposure proactively? Knowing which AI tools are in use is a good start, but you also need to know how sensitive data flows through AI systems.
A high-level architecture view
Crume walks through a typical flow. Training data feeds into training a model. A user enters a prompt, which may be augmented with other data sources through retrieval augmented generation (RAG). A context or policy layer overrides the whole process and may itself contain sensitive material, such as competitive advantages the organization would not want rivals to see. If the system is an agent, it reaches out to tools that may write code, access databases, or spawn further agents, which can spawn still more. Sensitive information is present at every stage. For each tool, the questions are whether it guards the data, whether the organization has control and visibility over it, and where the data ends up downstream.
The questions that need answers
Crume frames the challenge around five questions: what sensitive data AI is using, what data is actually exposed, whether that exposure was authorized and governed, how to investigate what happened as data moved through the AI, and how to enable AI adoption without opening data security gaps.
Two streams of visibility
The workload stream covers what happens inside AI systems. That means examining AI applications, RAG pipelines that bring in new information, and vector databases, which he calls the heart of many generative AI models. Crume stresses that data transformations must be tracked. Data that has been summarized, reformatted, or otherwise changed may no longer match the patterns you search for, so a leak can go unnoticed unless you recognize the transformed form. Organizations also need to show the sources of data and where it finally goes.
The workforce stream covers how employees use AI. This includes file uploads and downloads, copy and paste operations, and derived child files that come from a main sensitive file. Each child must be tracked just as the original is. Organizations also need to see how employees consume and share this information with one another.
Crume argues that both streams must feed a unified, end-to-end visibility and protection platform. Such a platform should provide lineage that follows data from source through an AI system to an endpoint, policies that apply consistently across all of these points and are both monitored and enforced, and a single pane of glass rather than a collection of disconnected monitoring tools. Above all, it should identify risk proactively rather than after data has already escaped.
Three discovery lenses, and why none is enough
Crume examines three partial views. Agentic platform discovery answers who prompted which model, which agent actually ran, and which Model Context Protocol (MCP) tool was called. Endpoint DLP discovery reveals which agents, extensions, and MCP servers exist on each device, along with files, memory, and other digital residue. Cloud or on-premises discovery shows which data sources exist, how they are classified, how sensitive the data is, and who owns it. Each lens sees only part of the picture, so what is really needed is a holistic view that integrates all three into a single model.
Requirements for managing AI data exposure
- AI-aware, continuous, automated data classification and discovery across all platforms. The system must recognize sensitive categories such as personally identifiable information, personal health information, financial data, and intellectual property, because the environment changes constantly.
- Lineage-driven risk visibility that shows how data propagates and transforms as RAG pipelines, agents, and other systems process it.
- Intelligent, context-aware investigation that weighs user sensitivity, destination, and other factors. Crume’s target is to shrink investigation time from weeks to minutes.
- Compliance reporting that demonstrates how AI usage aligns with regulations and standards, including the GDPR (General Data Protection Regulation), the EU AI Act, SOC 2, ISO 27001, and HIPAA.
Crume closes with an analogy. Data is the lifeblood of AI and has to keep moving, but if you cannot monitor where it goes, you may be hemorrhaging without knowing it. The system is complicated, but tools exist to help organizations manage their data exposure from AI.