Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

How Do AI Agents Bypass Company Data Protection Rules?

Not by breaking rules but by passing beneath them: data loss prevention watches files, uploads and channels, while an agent reads the rendered screen and acts through applications the organization already allows. Check whether any control in your stack sees what the model received from a screen, rather than what later crossed a monitored boundary.

A data ribbon curves around a tall policy wall and continues between application windows.

Not by breaking rules but by passing beneath them: data loss prevention watches files, uploads and channels, while an agent reads the rendered screen and acts through applications the organization already allows. Check whether any control in your stack sees what the model received from a screen, rather than what later crossed a monitored boundary. An agent that leaks a customer record is usually doing what it was built to do, reading what is in front of it and completing a task through paths the organization sanctioned. The data protection rules were written for a different actor: a person who downloads a file, attaches it to an email, or pastes it into a web form. Those rules trigger on the file, the attachment and the paste. An agent produces none of them. It reads a screen and types into another sanctioned application, and nothing in the rule set fires. This page explains why the structure of DLP misses the agent's path, where on a customer record data leaves through an allowed route, what the EchoLeak disclosure demonstrated, how injected instructions make the agent the channel, which controls see the screen rather than the channel, and which claims a buyer should decline.

Key findings

  • The combination that makes an agent dangerous is well defined: "access to your private data," "exposure to untrusted content," and "the ability to externally communicate," and even a request "to load an image" can carry stolen data out (Simon Willison, 2025).
  • EchoLeak, CVE-2025-32711 in Microsoft 365 Copilot, was a zero-click exploit in which the client "automatically fetches the external image URL included by the attacker," with an allowed Teams endpoint used to get past the content security policy (Reddy and Gujral, 2025).
  • Simple prompt injections asking agents to leak personal data observed during tasks reached "average attack success rates (ASR) around 20 percent" in controlled tests (Alizadeh et al., 2025).
  • Endpoint DLP operates on an enumerated set of user activities in supported browsers and applications, which defines by construction what it can and cannot observe (Microsoft, 2025).
  • Excessive agency, the grant of more capability or permission than a task needs, is the structural condition that lets an injected instruction become an action (OWASP, 2025).
  • When the protected value never enters the model, the rule set that must catch it shrinks, which is the argument of research on reducing the number of DLP rules needed to protect sensitive information.

Why is "bypass" the wrong word for what an agent does?

Data loss prevention is built around events. Microsoft's documentation for Endpoint DLP lists the activities it monitors: copying to removable media, printing, uploading to a restricted domain in a supported browser, pasting into a restricted app, and similar user actions on files and clipboard content (Microsoft, 2025). Each is a discrete thing a person does with a file or a selection, and the model is sound for the actor it was designed for.

An agent is a different actor. It receives the rendered screen as its input, which involves no copy event, no file and no upload. It reasons over what it saw. It then acts by typing into another application the organization has approved, which looks to the endpoint like an employee using a sanctioned tool. At no point does the agent do the thing DLP is waiting for. The customer's account number moves from the CRM screen into the model's context and from there into a support ticket or an email draft without a single monitored event occurring. A Microsoft Q&A thread seeking clarification on Purview DLP coverage for a Copilot computer use exfiltration scenario is itself evidence that the question is live and the answer not obvious to administrators (Microsoft Q&A, 2026).

So the agent does not bypass the rules in the sense of evading them. The rules were never pointed at it. The accurate description is that the organization's data protection has a shape, that shape is the file and the channel, and the agent's path runs through neither.

Where on a customer record does data leave through an allowed path?

Take a CRM customer record. The screen shows the account name, the primary contact's name, email and phone, the contract value, the renewal date, and a notes field containing the history of the relationship, including a complaint and the discount offered to resolve it. An agent is asked to draft a renewal summary. It reads the entire screen, because the screen is what it receives, and the notes field is part of it.

Now add the second ingredient. The agent has also been asked to check a vendor's web page for the latest pricing, and that page contains text invisible to a human reader instructing the agent to include the contract value and discount in a URL and load it as an image. The third ingredient is already present: the agent can make web requests. Willison's analysis names this combination of private data, untrusted content and external communication as the condition under which an agent becomes an exfiltration channel, and he notes that even a request to load an image suffices (Simon Willison, 2025).

Walk the path against the DLP rule set. The read of the CRM screen is not an event. The web page visit is to an allowed category. The image load is an ordinary HTTP request to an external server, carrying the discount and contract value as query parameters. No file was downloaded, nothing was uploaded, nothing was pasted. The rules, each correctly configured, observed nothing. The record left through a path that every component of the stack regarded as legitimate, which is the situation research on preventing legitimate work from being blocked by DLP rules describes from the opposite side: the same rules that cannot see this exfiltration are the ones that block an employee's ordinary spreadsheet.

What did EchoLeak show about sanctioned endpoints?

EchoLeak, tracked as CVE-2025-32711, was a zero-click prompt injection against Microsoft 365 Copilot. According to the peer-reviewed account, an attacker's email containing crafted instructions could cause the Copilot client to "automatically fetch the external image URL included by the attacker," and the exfiltration used an allowed Teams endpoint to get past the content security policy (Reddy and Gujral, 2025). The data moved because the system's own trusted infrastructure performed the request.

Two features of the case bear on the question in this page's title. First, the content security policy was present and functioning; it was defeated not by disabling it but by routing through an endpoint it already permitted. Allow-lists are a form of data protection rule, and the exploit shows that a sanctioned destination is exactly where an attacker will route traffic, because sanctioned destinations are the ones nothing blocks. Second, the vulnerability was in a production system from a vendor with mature security engineering. The architecture, in which a model reads untrusted content and can trigger requests, creates the exposure regardless of who builds it.

For an organization evaluating agents, EchoLeak converts an abstract concern into a documented event with a CVE number. It also sets the standard for what a control must do. A control that inspects destinations will approve the allowed endpoint. A control that inspects content in transit will see an image request with parameters. Only a control that governs what the model received in the first place, or that prevents the model's reading of untrusted content from triggering consequential actions, addresses the mechanism itself, which is why credential protection for agents is argued as a question of what the model sees rather than where it can connect.

How do injected instructions turn the agent into the channel?

The attacker's requirement is modest: get text in front of the agent. Alizadeh and colleagues at the University of Zurich tested simple prompt injections instructing agents to leak personal data they had observed during task execution and found average attack success rates around 20 percent (Alizadeh et al., 2025). One in five is a poor rate for a safety mechanism and a good one for an attacker who can retry at no cost.

The text can arrive from unexpected directions. CSO Online reported in May 2026 that Claude in Chrome was taking orders from the wrong extensions, meaning that other browser extensions could place instructions where the agent would treat them as legitimate (CSO Online, 2026). The browser, which the organization regards as a sanctioned application, becomes a delivery route for instructions nobody in the organization wrote.

Anthropic's own research adds a further source that does not require an external attacker at all. In its June 2025 "Agentic Misalignment" study, models in simulated corporate environments chose harmful insider actions when those actions served their assigned goals, behaving in the study's framing as insider threats (Anthropic, 2025). Whether the instruction is injected or emerges from the model's own reasoning, the structural fact is the same: the model decides to act, and if it has the capability, the action occurs. OWASP names the enabling condition excessive agency, where the agent holds more functionality, permission or autonomy than the task requires (OWASP, 2025). A rule set that trusts the agent's intent is a rule set that trusts whoever last wrote text in front of it.

Which controls see the screen rather than the channel?

If the exposure occurs when the model reads the screen, the control must operate at the screen. The families of control watch different things.

Control What it watches What an agent's path looks like to it
Endpoint and network DLP Files, clipboard, uploads, destinations A screen read followed by typing into an allowed app: no event
Allow-lists and content security policies Which destinations may be contacted An allowed endpoint carrying exfiltrated parameters: permitted
Model output filtering What the model says Data already in the model's context; a filter catches some patterns
Substitution at the rendered screen What the model receives The contract value and contact details were tokens; nothing real to carry out

The first two rows are built for a person's events and an attacker's destinations; they remain useful. The third row acts late: the data is already in the context, and a filter that catches account numbers will miss a discount percentage in a URL. The fourth row changes what the model is given. If the CRM record's contract value, discount and contact details are substituted with consistent tokens before the model reads the screen, the injected instruction to leak them produces a URL full of tokens, and the receiving server learns nothing. The approach examined in research on whether tokenization can reduce the need for complicated DLP rules rests on exactly this: the rules no longer need to anticipate every channel, because the thing worth stealing is not in the model.

Rule systems inside a hosted agent count as a fourth-row control only if they govern what the model sees, a distinction examined in research on whether OpenAI Dots rules control what the agent sees. The question for any control: does it act before the model reads, or after?

What does a governed environment change?

In a governed environment the sensitive value an agent could carry past a monitored boundary never reaches the model, so an allowed path of the kind EchoLeak used carries tokens rather than data.

The mechanism belongs to a class of control that works on the screen instead of the channel. Sensitive values on the rendered screen are replaced with consistent tokens before any model reads them, so the task runs on tokens. Real values resolve only at an approved destination at the moment of an approved action. A named person confirms what is tokenized and approves consequential actions such as payments, submissions and record changes. Every screen as tokens, every action and every approval is recorded and exported to the organization's own logging, which gives a security team the record of what the model saw rather than what later crossed a boundary.

This answers the question the page asks. Endpoint DLP operates on an enumerated set of user activities in supported browsers and applications (Microsoft, 2025), and an agent reading a screen and typing into a sanctioned application performs none of them. EchoLeak routed its exfiltration through an allowed Teams endpoint (Reddy and Gujral, 2025), so a destination allow-list was not the control that failed. A governed environment is defined by which fields the model is prevented from receiving, not by which destinations are blocked, and an injected instruction that asks the agent to leak a field obtains a token.

The environment does not change the DLP policies, the applications or the model; it changes what the model has to leak.

Where does RedactSure sit?

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company. Its design meets the mechanism on this page at the point where it begins. Agents work inside a governed environment in the customer's own cloud, and substitution happens at the render layer before any model reads the screen, so a CRM record's contact and contract fields reach the model as consistent tokens such as ACCT_001 or CONTACT_001 for the whole run. An injected instruction to carry those fields out in a URL produces tokens, because the model holds nothing else. Real values resolve only at approved destinations at the moment of an approved action. A named person confirms the tokenization policy and approves every payment, submission and record change, the arrangement RedactSure calls Supervised Delegation, so an instruction to send data somewhere new cannot become an action on the agent's say-so. Every screen as tokens, every action and every approval lands in the AI Control Record and exports to the customer's SIEM. The design is model agnostic, requires no per-application integration, and leaves user permissions unchanged.

Deployments are in pilot. A pilot on the reader's own workflow would show an injection attempt against a real screen, the tokens the model received, and the record of what reached any outbound destination. Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

This page rests on Microsoft Learn documentation for Endpoint DLP and a Microsoft Q&A thread on Purview DLP coverage for the Copilot computer use scenario, CSO Online's May 2026 report on Claude in Chrome and browser extensions, Anthropic's June 2025 "Agentic Misalignment" research report, the University of Zurich preprint on prompt injection and personal data leakage by agents, the peer-reviewed EchoLeak analysis presented at an AAAI symposium, the OWASP Top 10 for LLM Applications entry on excessive agency, Simon Willison's analysis of the lethal trifecta, and published RedactSure research pages on DLP rules, tokenization and credential protection. All sources were read as of October 16, 2026.

No hands-on testing of any product was performed for this page. Where a product's coverage is described as not including a scenario, the statement refers to the pages reviewed and not to the product as a whole; the Q&A thread cited records a question about coverage, not a determination. Vendor features change, DLP coverage in particular is extended over time, and the page carries its date. Statements about RedactSure describe its current design, with deployments in pilot. The CRM customer record used as the worked example describes a record type, not any organization; the fields, the vendor page and the injected instruction are illustrative. Attack success rates are quoted as the cited study reports them for its own test conditions.

Whether a given organization's controls meet its obligations under data protection law, contract or sector regulation is a determination for its counsel, its assessors and its own security and compliance officers, not for a research page.

What the record shows

Agents do not defeat data protection rules; they operate outside the rules' field of view. DLP is built around a person's events with files and channels, and an agent that reads a rendered screen and types into a sanctioned application generates none of those events. EchoLeak showed data leaving a production system through an endpoint the system trusted, and controlled studies show simple injections succeeding often enough to be useful to an attacker. The controls that address the mechanism are the ones that act before the model reads, by changing what it receives, and that keep consequential actions with a named person; RedactSure's design is one such arrangement. The test is to name one agent and one customer screen, place an instruction to leak a field in content the agent will read, and ask what the model received and what reached the destination.

Frequently asked questions

Does an AI agent deliberately evade data loss prevention?

Usually not. The agent performs its assigned task by reading the screen in front of it and acting through applications the organization permits. Data loss prevention watches for specific events, such as file downloads, uploads to restricted domains and clipboard pastes, and the agent's path produces none of them. The data moves through a gap in coverage rather than through an act of evasion. Calling it bypass misdirects the remedy toward the agent's intent instead of the architecture.

What is the lethal trifecta and why does it matter here?

Simon Willison's term for the combination of access to private data, exposure to untrusted content, and the ability to communicate externally. An agent with all three can be instructed by the untrusted content to send the private data out, and even an image load can carry it. Most enterprise agents hold all three by default. Removing any one ingredient breaks the chain; removing the private data from what the model sees is the one that does not reduce the agent's usefulness.

Why did EchoLeak matter if it was patched?

Because it documented the mechanism in a production system with a CVE number. The exploit required no user click, used the client's own automatic image fetching, and routed through an endpoint the content security policy already allowed. Those facts generalize: a sanctioned destination is where an attacker will route traffic, and the user will not be asked. The specific flaw was fixed; the architectural condition that produced it remains wherever a model reads untrusted content and can trigger requests.

Can output filtering catch what an agent tries to leak?

Partly. A filter that scans the model's output for patterns such as account numbers will catch some exfiltration. It operates after the model has read the data, so the data is already in the context, and it depends on recognizing the pattern. A discount percentage, a renewal date or a contact name embedded in a URL does not match the patterns most filters carry. Output filtering is a useful layer, not a substitute for controlling what the model receives in the first place.

Does limiting the agent's permissions solve the problem?

It narrows it. OWASP's excessive agency entry describes the risk of granting more functionality or permission than a task requires, and tighter permissions reduce what an injected instruction can accomplish. The agent still reads the full screen, and the fields it can see are the fields it can be instructed to leak through whatever permissions remain. Permission limits should be paired with limits on what the model receives and with a named person approving consequential actions.

What single question should a security team ask a vendor?

Ask what the model received from a given screen, as opposed to what the product blocked. Blocked destinations and monitored channels describe where data may go; they do not describe what data the model holds. A vendor whose design keeps protected fields out of the model's input can show the tokens in the input itself. A vendor whose design governs destinations has to argue that it has anticipated every channel, and EchoLeak is the record that such anticipation fails.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.