New Research: AI Is Already the #1 Data Exfiltration Channel in the Enterprise

A new LayerX report reveals that AI is already the single largest uncontrolled channel for corporate data exfiltration, surpassing shadow SaaS and unmanaged file sharing. Based on real‑world enterprise browsing telemetry, the study shows sensitive data already flowing into ChatGPT, Claude and Copilot at staggering rates, with 40% of files uploaded into GenAI tools containing PII or PCI data.

Notably, the real leakage channel is copy/paste, with 77% of employees pasting data into GenAI tools and 82% of that activity occurring from unmanaged accounts, averaging 14 pastes per day per employee and at least three containing sensitive data. The findings also highlight governance gaps: 71% of CRM logins and 83% of ERP logins bypass federation, making corporate credentials effectively indistinguishable from personal ones.

The report urges security teams to treat AI security as core, shift to action‑centric DLP, restrict unmanaged accounts, and prioritise high‑risk categories like AI, chat and file storage to regain visibility and control. According to LayerX, the implications are urgent for CISOs seeking to secure AI‑driven workflows across the enterprise.