AI processes need their own DLP

I have spent a lot of time in the gap between a developer's tools and the model provider. Watching what crosses that gap changed what I think the main risk is.

Most teams worry about what people paste into a chat window. That risk is real, and a small local proxy handles it well. You point the tool at a local address, the proxy scans the prompt, and an AWS key becomes a placeholder before the request goes out.

The larger risk is that an agent is a process, and a process acts. It reads your files. It runs shell commands. It holds your tokens. A person pastes one secret at a time. An agent can read a whole directory and send it somewhere without anyone seeing a prompt.

Where the old DLP stops

Classic DLP watches mail, uploads and the network edge. It looks for known patterns in known channels. An agent works across all of them at once, from inside the developer's session, with the developer's permissions. The edge sees an HTTPS call to a model provider, which is the traffic you allowed.

Here is my claim, and I expect some security engineers to reject it. Redacting prompts is necessary and not sufficient. The control that matters for agents is on the endpoint, before a command runs.

A poisoned AGENTS.md in a cloned repo can tell an agent to fetch a script and pipe it into a shell. No prompt is sent to a provider at that moment. The agent follows its instructions locally. A proxy never sees it. Only something on the host sees the process start, and only something that decides before the exec can stop it.

Logging after the fact is a report, not a control

Many tools record what an agent did. That helps with an investigation. It does not help the developer whose token is already gone. I want the agent to judge the command on the device and deny it while the process is still waiting to start.

This is harder than it sounds. A rule that matches curl | sh misses the same pipeline once an agent wraps it in quoting. A rule that follows process ancestry loses the agent when launchd starts a job on its behalf. A defense that hides its own blind spots teaches the team to trust it too much.

What I would tell a security lead

Treat each AI tool as a new kind of employee that never sleeps and never asks what a file contains. Give it the least access that works. Put a gate in front of what it can run and what it can send.

Keep the gate local. Raw command arguments and prompt text should stay on the machine. The device can judge on full data and report only a verdict.

Attackers already target these tools. The defenses have to run where the agents run.