How to Prevent Sensitive Documents From Being Uploaded to AI Tools

Disclosure. Strike Labs makes Strike Gate, a marking scanner with a browser extension that can screen files headed to AI tools. It covers a small part of the problem described here. We say exactly which part in the section on Strike Gate, and we describe the other controls fairly. If anything here is wrong or out of date, tell us and we will correct it.

An employee summarizes a proposal. A developer pastes a config file to debug it. An analyst uploads two financial reports to compare. A meeting bot transcribes a program review. An agent reads a shared drive to answer a question.

Each can be productive and appropriate. Each can also move sensitive information into a service the organization never approved for that data.

The problem is not AI itself. It is information crossing a boundary — from an environment authorized for it into one that is not. AI just made that crossing fast, frequent, and easy to miss.

It is also common. Vendor telemetry studies (from companies that sell AI-security products, so read them with that in mind) consistently report that a large share of workplace AI use involves sensitive data. LayerX's 2025 report found that most pastes into AI tools came from personal, unmanaged accounts the employer could not see (The Register). Harmonic found that about one in five sensitive-data exposures went to tools that may train on user inputs (Harmonic).

What's at risk, and how hard it is to detect

Different kinds of information need different detection methods. Some are easy to spot automatically; the most damaging often are not.

The pattern: tools catch what has a format. Policy, training, and labels have to cover what doesn't.

Every way data reaches AI

"Uploading to ChatGPT" is one channel among many. Each channel is visible to different controls, which is why no single product covers them all.

"Partial" usually means the control sees the destination but not the content, or sees content only on some sites, browsers, or file types. Read vendor claims against this map. Ask which rows they actually cover, and test it.

Agents and embedded AI: when nobody uploads anything

Most guidance assumes a person chooses to send a file. That assumption is breaking.

Embedded assistants search what users can already reach. Copilot in Microsoft 365, Gemini in Google Workspace, and similar tools answer questions by searching the files, email, and chats a user has permission to open. If a sensitive folder was overshared years ago, the assistant can now surface it in seconds. The AI didn't create the exposure; it made old permission mistakes easy to exploit. Fix permissions and apply sensitivity labels before turning these tools on broadly.

Agents read files on their own. Coding agents, desktop agents, and tools connected through the Model Context Protocol (MCP) can open files, browse drives, and call other tools without a human picking each file. A pre-submission check that relies on a person clicking "upload" never runs. Controls have to sit where the agent works: which folders and connectors it can reach, what credentials it holds, and which model endpoint receives its context.

Local tools don't make the agent local. A scanner or other tool may run entirely on the device, but the AI assistant calling it may send the file, extracted text, or results to a model provider. Evaluate the agent's model endpoint as a separate data flow.

Meeting bots capture CUI without a keystroke. A transcription bot in a program review records everything said. Treat AI notetakers as cloud services that receive whatever is discussed.

Practical controls for this category:

• Scope agent access to specific folders and connectors, not whole drives or accounts.
• Use enterprise or government-authorized model endpoints for agents that touch sensitive work.
• Clean up overshared sites and apply labels before enabling embedded assistants.
• Block unapproved meeting bots at the meeting-platform level.
• Log agent actions where the platform allows it.

For government contractors: which AI fits which data

No DFARS clause or NIST control names generative AI. They don't need to. An AI service that receives your data is an external cloud service, and the existing rules apply to it.

• DFARS 252.204-7012. If a cloud service stores, processes, or transmits covered defense information (CUI), it must meet the FedRAMP Moderate baseline or an equivalent, as defined in the DoD CIO's December 2023 memo on FedRAMP Moderate equivalency. The clause also requires reporting cyber incidents to DoD within 72 hours (analysis).
• NIST SP 800-171. An AI tool outside your boundary is an external system; your system security plan has to account for it.
• CMMC. Phase 1 began November 10, 2025, with self-assessments. On July 13, 2026, DoD paused Phase 2, which would have made third-party (C3PAO) assessments the default starting November 10, 2026. Self-assessment requirements remain (Wiley). Check current status before you rely on either date.
• ITAR and EAR. Export-controlled technical data needs controls on where it is stored and who can access it, including foreign-person access. Get your export compliance lead's approval before any AI service touches it.
• Classified information. Never on any commercial or government-cloud AI service. Only on systems accredited for that level.

A starting map

This is a general starting point, not legal or compliance advice. Your contract, DD Form 254, and security team decide.

What's available now (verify before relying on it)

Government-authorized AI changed fast in 2025–2026. As of October 2026, public reporting shows:

• Microsoft 365 Copilot in GCC High reached general availability in December 2025, operating under the GCC High FedRAMP High authorization (Daymark). For many defense contractors already on GCC High, this is the most direct path.
• OpenAI lists ChatGPT FedRAMP and its FedRAMP API at FedRAMP 20x Moderate (OpenAI).
• Anthropic's Claude for Government became generally available to federal and state agencies on September 30, 2026, in a FedRAMP High environment (TechRepublic).
• Google's Gemini for Government lists FedRAMP High authorization for the Gemini app and Workspace features (A-Frame).
• GenAI.mil, DoD's enterprise AI platform, hosts several frontier models at Impact Level 5 for CUI — for DoD personnel, not contractor systems (ExecutiveGov).

Three cautions:

• "For Government" often means for agencies. Several of these offerings are sold to government agencies and may not be available to contractors. Confirm eligibility.
• A FedRAMP authorization covers the service, not your use of it. You still have to configure it inside your boundary, document it in your SSP, and meet your contract's specific terms.
• Feature parity lags. Government-cloud versions often lack commercial features and connectors. Check that the features your team will actually use are inside the authorized boundary.

Layered defense

No single control covers every channel, so mature programs stack them. Each layer sees things the others can't.

Controls nearer the data (labels, permissions) work regardless of channel. Controls nearer the AI service only cover the services you've approved. Anything that leaves through a personal device or account bypasses all four layers, which is why policy and a good approved tool matter as much as technology.

Controls compared

Three capabilities get blurred together in marketing. Keep them separate:

• Detect — identify possibly sensitive material.
• Warn — tell the user before they act.
• Block — stop the action under an enforced policy the user can't simply dismiss.

A warning a user can click past is not enforcement. Neither is a browser extension the user can disable.

Vendor names are examples, not endorsements or a complete list. Capabilities vary by edition and configuration; verify each claim in your environment.

Detection methods and where they fail

Two trade-offs matter in practice:

• False positives train people to click past warnings. Tune rules before enforcing, and measure override rates.
• Every check that runs in the cloud is itself a data flow. A detection service that sends content to a vendor's server for classification creates the exposure it's meant to prevent. Ask where detection happens.

How controls get bypassed

Every control here is aimed mainly at mistakes, not determined insiders. Be honest about that in your risk assessment. Common bypasses:

• Screenshots. Multimodal models read images. A screenshot of a marked page skips text-based scanning entirely.
• Phone cameras. A photo of a screen goes through a personal device and network no corporate control sees.
• Retyping and paraphrasing. Rewording removes markings and defeats pattern matching.
• Splitting. Sending a document in small pieces can keep each piece under detection thresholds.
• Switching browsers or accounts. An extension in one browser doesn't protect another; a personal account bypasses enterprise settings.
• Disabling the control. Users with admin rights can remove extensions or agents.

Mitigations exist for some — OCR for images, managed browsers that can't be swapped, removing local admin rights — but none for all. Insider risk needs separate controls: access limits, monitoring, and accountability.

Find the AI you don't know about

You can't control tools you haven't found. Start with an inventory:

• Network and gateway logs — traffic to known AI domains.
• OAuth and SSO grants — AI apps users have connected to email, drives, or calendars.
• Browser extension inventories — AI sidebars and writing assistants on managed browsers.
• Installed software — desktop AI apps and coding assistants on managed endpoints.
• Meeting platforms — bots that have joined meetings.
• Expense reports and card statements — personal AI subscriptions charged back to the company.
• Asking people. A no-blame survey of what teams actually use often finds more than logs do, and tells you which approved tool to provide.

The usual finding: people use unapproved AI because the approved option is missing or worse. Providing a good approved tool reduces shadow use more than blocking does.

If sensitive data was already submitted

Almost every guide skips this. Have the plan ready before you need it.

If it might be classified:

1. Stop. Don't forward, screenshot, or re-upload anything to "check."
2. Contact your FSO immediately and follow their direction. Treat it as a potential spill.
3. Preserve what you know: which tool, which account, what time, what was sent.

If it's CUI or other controlled data:

1. Notify your security lead right away. Under DFARS 252.204-7012, a cyber incident affecting covered defense information must be reported to DoD within 72 hours of discovery; your security team decides whether this qualifies.
2. Record the tool, account type (personal or enterprise), time, and what was submitted.
3. Delete the conversation and uploaded files in the tool, and check the vendor's retention terms — deletion from your view may not mean deletion from the vendor's systems.
4. Contact the vendor's privacy or security team to request deletion and confirm whether the data was used for training.
5. For export-controlled data, involve export compliance; an unauthorized export may need a voluntary disclosure.

If it's personal data or business confidential:

1. Follow your incident-response plan; privacy laws or contracts may set notification duties.
2. Delete, request vendor deletion, and rotate any exposed credentials immediately.

Afterward: find out why it happened. Was there an approved alternative? Did a control miss it? Fix the gap, not just the person.

Test your controls before you trust them

A control you haven't tested is an assumption. Test with synthetic files only — never real sensitive data.

Build a test set covering each category you care about:

• Markings: documents with fake but correctly formatted classification banners, portion marks, and CUI markings. Strike Gate publishes free synthetic samples (a classified-marking PDF, a CUI PDF, and a Word file) that anyone can download and use against any tool, ours or not.
• Credentials: publicly documented example keys, such as AWS's AKIAIOSFODNN7EXAMPLE.
• Payment cards: processors' published test card numbers.
• SSNs: numbers in ranges the Social Security Administration never assigns, such as those beginning with 000 or 666.
• Clean controls: ordinary files that should not trigger anything.

Run each file through each channel in the channel map: upload, paste, drag-and-drop, screenshot, desktop app, a second browser, a personal account. Record what each control detects, warns on, and blocks.

Measure: missed detections, false positives, how easily a warning can be dismissed, and whether any content left the device during the check.

The result is your real coverage map. It is usually smaller than the vendor slides suggest.

Where Strike Gate fits

Strike Gate covers one row of one table above: detecting classified and CUI markings in PDF and Word files, locally, before they're shared. Its browser extension can check files headed to AI sites; its web app, Office add-in, CLI, and MCP server check files in other workflows.

What it does not do:

• Detect credentials, personal data, source code, or unmarked sensitive content.
• Read text in images or screenshots.
• Enforce policy centrally. It warns; a user can choose to proceed.
• Cover desktop AI apps, embedded SaaS assistants, APIs, agents acting on their own, phones, or unsupported browsers.

If you need enforcement, use the managed controls above and treat Strike Gate as an extra check for markings.

Verify coverage in your environment

This guide does not publish a verified site-by-site coverage matrix. Browser support and AI-service behavior can change over time. Test the browsers, services, and file types your team uses with synthetic documents before relying on an extension.

Template: one-page AI acceptable-use policy

Adapt this to your organization. Have counsel and your security team review it.

# [Company] AI Acceptable-Use Policy
Effective: [date] · Owner: [security lead] · Review: every 6 months

## Approved AI tools
| Tool | Approved for | Account type |
|---|---|---|
| [e.g. Microsoft 365 Copilot, GCC High] | Up to CUI, within our assessed boundary | Company SSO only |
| [e.g. ChatGPT Enterprise] | Public and internal business data | Company SSO only |
| Anything else | Public information only | — |

## Never enter into any AI tool
- Classified information
- ITAR/EAR technical data, unless export compliance approves the tool
- CUI, except in tools approved for CUI above
- Passwords, keys, tokens, or credentials
- Personal data of employees or customers, unless approved

## Rules
- Use company accounts only. No personal AI accounts for work.
- Do not connect AI tools to company email, drives, or calendars without approval.
- Do not let AI notetakers join meetings that discuss CUI or contract details.
- Agents and coding assistants may access only approved folders and repositories.
- Review AI output before using it; you are responsible for what you send.

## If something goes wrong
Report it to [security contact] immediately. Do not delete evidence or try to
fix it yourself. Prompt reporting is never punished; hiding a mistake is.

## Requesting a new tool
Submit [form/link]. Security reviews data handling, authorization, and contract terms.

A practical starting plan

You don't have to solve everything at once.

First 30 days — know what you have

• Inventory AI use (logs, OAuth grants, extensions, a no-blame survey).
• Define prohibited data and publish the acceptable-use policy.
• Pick one approved AI tool for general work and roll it out with company SSO.
• Write the incident plan for "someone already pasted it."

Days 31–60 — add guardrails where mistakes happen

• Clean up overshared sites and apply sensitivity labels before enabling embedded assistants.
• Add pre-submission screening in the browser for the highest-risk categories.
• Scope agent and coding-assistant access to approved folders and repositories.
• Block unapproved meeting bots.

Days 61–90 — enforce and measure

• Move from warnings to blocking where false positives are low.
• Extend controls to endpoints and the network for managed devices.
• Run the synthetic test set across every channel and record real coverage.
• Review events and override rates monthly; update rules and the policy.

The goal is responsible AI use, not zero AI use. People route around tools that only say no. Give them an approved path that works, and put the guardrails on it.

Strike Gate flags patterns for human review. It does not make classification decisions or authorize handling. Follow your organization's approved procedures.

Related guides

• Choosing document screening tools for defense contractors
• How to verify a document scanner doesn't upload your files
• How to check a document for classified or CUI markings before sending it

Sources

• CISA, NSA, FBI et al. — AI Data Security: Best Practices (May 2025)
• Secureframe — AI governance for CMMC Level 2 (DFARS 7012 and FedRAMP equivalency)
• Wiley — DoD pauses CMMC Phase 2 (July 2026)
• Daymark — Microsoft 365 Copilot in GCC High
• OpenAI — Solutions for government
• TechRepublic — Claude for Government generally available
• A-Frame — GSA OneGov AI agreements
• ExecutiveGov — Navy designates GenAI.mil for CUI and IL5
• The Register — LayerX Enterprise AI and SaaS Data Security Report 2025
• Harmonic — GenAI in the Enterprise, Q3 2025
• Microsoft Purview licensing guidance
• NIST AI Risk Management Framework