guide
Oct 17, 2026AI DLP keeps secrets, source code, and personal data out of LLM prompts and agent tool calls. How it differs from classic DLP, and where each control belongs.
AI DLP (AI data loss prevention) is the set of controls that keep secrets, source code, and personal information from being sent to an AI model in prompts, file reads, tool calls, and tool outputs, and that record what was exposed when a control misses.
Classic data loss prevention software watches email, USB drives, and file uploads. Those tools assume a person is moving a file through a known channel. A coding agent is different: it reads the repo and runs shell commands on its own, then sends the result to a model API over ordinary HTTPS. This guide defines AI DLP, the four ways data leaks, the four places you can put a control, and what each control cannot do.
If you want the Claude Code .env case in detail, start with .claudeignore doesn't stop Claude Code reading your .env.
Traditional DLP looks for a person doing one of three things:
An AI coding session does not look like those events. It is an HTTPS request to a host you may already allow, such as api.anthropic.com or api.openai.com. The body is JSON: a prompt, a file excerpt, or the output of a command. A firewall that only checks the destination sees an allowed API call.
ChatGPT in a browser usually waits for a person to paste. Claude Code, Cursor, and Codex do not. Ask one of them to fix a database error and it may:
.env, config.yaml, or a credentials file.grep, cat, or a migration command.Nobody pasted it. OWASP LLM02:2025, Sensitive Information Disclosure, describes this class of leak: secrets and private data end up in prompts, logs, and other systems the team did not mean to share them with. That is not the same as claiming every provider trains on your prompt. Check the provider's data terms for that.
A September 2026 GitGuardian study reported 24,008 unique secrets in public Model Context Protocol (MCP) server configs, of which 2,117 were still valid. MCP is a way for an assistant to call external tools. Those counts are GitGuardian's, from public configs, not a measure of your repo.
| Path | What happens | A familiar example |
|---|---|---|
| 1. A person pastes | Text goes into the prompt | A curl command that still has a bearer token |
| 2. The agent reads a file | The assistant opens a path itself | .env, a .pem key, .aws/credentials |
| 3. A command or tool prints it | The secret is in command output or an MCP response | printenv, a script that loads .env, a logs command |
| 4. A copy is kept | The text is stored after the reply | A local transcript, a vendor log, a shared session |
Path 4 is why "we closed the chat" is not a cleanup plan. Claude Code, for example, writes plaintext session transcripts on the laptop. See the Claude Code guide linked above for the exact folder and the retention setting.
You want a control at each path. No single layer sees all four.
| Layer | Where it runs | What it can do | What it cannot do | |---|---|---|---| | 1. Tool settings | Inside the assistant (deny rules, ignore files, Copilot content exclusion) | Block some file reads the product knows about | Often misses shell output, scripts, and MCP tools. Some ignore files are not enforced at all | | 2. Hook DLP | A small program on the laptop, run before or after a tool | Replace recognized secrets in prompts and tool output before the model request. Block an env-file read it cannot safely redact | Only the machines where it is installed. A deleted hook protects nothing. An unexpected error on a tool that is not an env-file read does not stop that tool | | 3. Gateway | A proxy your tools call instead of the provider | Keep provider keys off laptops, limit models, log the requests that pass through it | Local file reads that never become a request. Calls a laptop makes directly to the provider | | 4. Detection and audit | A console after the fact | Alerts, coverage, and an export for review | It does not undo a request that already left |
A longer comparison of hook DLP, endpoint agents, and AI detection-and-response tools is in Hook DLP vs endpoint AI DLP vs AIDR. The short version of hook versus a traditional endpoint agent is Hook DLP vs endpoint DLP.
Tool settings are real and worth turning on. They are not the whole control. GitHub's Copilot content exclusion and Cursor ignore files are examples: they change what that product indexes or opens. They do not inspect every child process.
Hook DLP is the layer that can see tool output on the machine. A hook is not malware protection and not mobile device management (MDM). MDM is the system that locks settings on a company laptop. Hooks are files the user can remove. Measuring coverage without MDM is about how you notice when they are gone.
A gateway is useful when you want one place for provider keys and model choice. It is the wrong tool for "did the agent open .env on the laptop?" It only sees traffic sent through it.
Detection tells you what the other layers missed. It is late by design. Use it for evidence, not as the only block.
Ask a product which of these it handles, and whether that is a block, a redaction, or only an alert.
Credentials. Cloud keys, API tokens, database URLs with passwords, private keys, and env files. This is the case hook DLP is built for: known shapes and exact text, not a judgment about the paragraph.
Personal information. Names, emails, and customer rows in a debug paste. For Canadian organizations, PIPEDA still expects you to account for personal information that leaves a laptop. A technical control can support that. It is not legal advice, and it does not mean a product "meets PIPEDA."
Specific internal strings. An internal hostname you do not want in a prompt. ReclaimLLM can apply substitutions you configure: the exact text you list is replaced with the placeholder you list. That is still a string match. It will not infer that a sentence describes your network.
ReclaimLLM's hook does not claim to understand source code or to catch every personal name. If a vendor says the model "knows" what is sensitive, ask to see the rule.
This is one implementation of the taxonomy above, not a claim that the taxonomy requires this product.
Tool settings stay yours. Deny rules and content exclusion are configured in Claude Code, Cursor, or Copilot. ReclaimLLM does not replace them.
Hook DLP. rclm-hooks-install registers hooks for Claude Code, Cursor, Codex, Gemini CLI, and GitHub Copilot agent mode in VS Code. Antigravity install is capture-only. Copilot inline completions do not pass through these hooks. DLP is on by default. --no-dlp turns it off.
When a tool result contains a recognized secret, the hook replaces the value before the model request, using placeholders such as [REDACTED:API_KEY]. Env-file reads hide the values in that file. Other command output is filtered to values that look like secrets, so a short setting such as PORT=5432 is not treated as a key. If an env file cannot be read safely, or it exceeds the size limit (1 MB per file, 8 MB of env files in the workspace), that env-file tool call is blocked. An unexpected error on a different tool does not block it. Shadow mode, described in measuring token waste, does not turn this redaction off.
--exclude-folder skips upload for sessions under a path. It does not stop the assistant from reading that folder.
Gateway. The enterprise LLM gateway holds provider keys on the server. Developers use a team credential. Admins can limit which models a team may call. The gateway does not see a file read that stayed on the laptop, and it does not see a tool pointed straight at the provider.
Detection. A few detectors are enough to know the shape of the system:
Retention. Paid and enterprise plans can encrypt stored sessions. The recovery key is shown once. Regions for stored data are the US and the EU. There is no Canadian residency option.
Walkthroughs: compliance and Signals. Docs: sensitive data, native hooks, gateway.
cat and a script are the usual bypass of an ignore file.You do not need a full endpoint suite on day one. A practical order:
.env and key files.That is LLM security work a small team can run. It will not catch every paste, and it will not satisfy a framework by itself.
AI coding assistant DLP is the product page for this setup. The sensitive data docs are the configuration reference.
AI DLP is data loss prevention for AI tools. It covers prompts, file reads, tool calls, and tool output, and it keeps a record when something sensitive gets through. It is not email DLP with a new name.
Traditional DLP watches channels a person uses to move a file: mail, USB, uploads. AI DLP also has to watch an agent that reads files and runs commands, then sends the text to a model API that looks like normal HTTPS.
It can, if the product hooks that assistant. ReclaimLLM hooks Claude Code, Cursor, Copilot agent mode, Codex, and Gemini CLI. Copilot inline completions do not go through those hooks. Antigravity hooks are for capture, not this redaction path. "Works with" means those hook points exist. It does not mean every secret is caught.
It can remove secrets that match a known shape or a string you listed, before the request is sent. It can miss a secret that does not match. After the provider has the prompt, redaction cannot retract it.
If developers run coding agents on machines that have production keys or customer data, yes, some control belongs there. The minimum is deny rules plus hook redaction plus a way to see that the hook is still on. You do not need MDM to start.
No. It can support access-control and audit evidence for AI coding tools. It does not complete a SOC 2 examination. ReclaimLLM is targeting SOC 2 Type II in early 2027. That is a target date, not a certification.