Prevent Data Leak to Shadow AI
AI code security is the set of practices and tools that stop source code, credentials, and customer data from leaving a company through AI coding assistants like ChatGPT, Copilot, Cursor, and Claude Code. It became its own category once teams realized that firewalls and email scanners never watched the one channel developers use most: the prompt box.
Most companies still treat this as a policy problem. Write a rule, tell people not to paste secrets, move on. That approach assumes engineers read policy docs at 2am when they're trying to ship a fix. So the leak keeps happening, quietly, one prompt at a time.
What AI code security means
At its simplest, AI code security covers everything that keeps sensitive code and data from reaching a third-party model without control or visibility.
That includes account settings, network-level filtering, secret scanning, and a newer approach called mutation, where sensitive values get swapped for realistic stand-ins before a prompt ever leaves the developer's machine.
At Pretense, we use the mutation approach, which replaces sensitive identifiers like API keys with deterministic, semantically equivalent synthetic identifiers rather than simply redacting them.
Why AI Code Security became its own Category in 2026
AI coding tools went from novelty to default, with most professional developers using one regularly, according to the Stack Overflow 2025 Developer Survey. And the tools built to stop data loss, the DLP and CASB products companies already owned, were built for email attachments and file uploads.
Nobody updated them for a text box that accepts anything, including a full file of production code pasted by hand.
The gap between those two facts is where this category lives. Security teams noticed the traffic they couldn't see. Engineering teams noticed the traffic they didn't want to give up.
AI code security is the attempt to reconcile both.
There's also a generational shift underneath this. A decade of security investment went into the perimeter: firewalls, endpoint agents, network segmentation. That investment assumed the dangerous action was a file moving across a boundary.
AI coding tools broke that assumption quietly, because the boundary a browser tab crosses doesn't look like a boundary at all. It looks like normal work. Nobody rings an alarm when an engineer opens a new tab to ask a question.
How code and secrets leak to AI tools
There are four code and api key leak paths to ai tools and most companies only have eyes on the first one.
- -
Chat pastes. An engineer copies a function, a config file, or a stack trace into ChatGPT or Claude to get help. This is the most visible path and the easiest to picture, which is probably why it gets the most attention. It's also often the smallest slice of actual exposure.
- -
IDE assistants. Copilot, Cursor, and similar tools read open files and surrounding context automatically, without an explicit paste. A developer working in a file with a hardcoded API key doesn't have to do anything wrong. The assistant already has it in context.
- -
CLI agents. Command-line coding agents can read entire directories, run scripts, and pull in whatever files sit next to the one being edited. The blast radius here is larger than a single paste because the agent decides what's relevant, not the human.
- -
Autocomplete. Inline suggestions send fragments of the surrounding file to a model on nearly every keystroke in some tools. It's continuous, it's invisible, and almost nobody thinks to audit it.
To be honest, nobody on that list of four paths is trying to cause harm. An engineer pasting a stack trace at midnight is trying to ship a fix before an on-call shift ends.
A CLI agent pulling in three neighboring files is doing exactly what it was designed to do: gather context to give a better answer. The leak isn't a failure of judgment so much as a mismatch between how these tools were built to be helpful and how little visibility that helpfulness leaves behind.
That mismatch also explains why blocking alone rarely holds up over time. An engineer who genuinely needs an AI tool to debug a production issue at 2am, and finds it blocked, will generally find a way around the block rather than wait for a ticket to be resolved. The block doesn't remove the need. It just removes the visibility into how that need gets met.
The number that gets cited most often comes from IBM's Cost of a Data Breach 2025 report: unsanctioned AI use added roughly $670,000 to the average cost of a breach.
The same report found that one in five breaches now involves an AI tool nobody approved, and that 97 percent of AI-related breaches happened with no access controls in place at all.
Approaches to protection, compared
Three approaches dominate right now, and they trade off differently.
| Approach | What it does | Where it breaks down |
|---|---|---|
| Blocking | Stops the prompt from being sent at all | Engineers route around it or stop reporting it |
| Redaction | Strips sensitive fields before sending | The model loses context and accuracy drops |
| Mutation | Swaps sensitive values for realistic stand-ins, restores them in the response | Requires a local agent to run correctly |
Blocking is the blunt instrument. It works until an engineer needs the tool to do their job, at which point they find a way around it, usually one that's harder to see than the thing you tried to stop.
Redaction is more thoughtful but has a real cost. Strip out the patient ID, the variable name, the connection string, and the model is left guessing at what used to be there.
In our own testing at Pretense, accuracy degraded by 20 to 30 percent over a few prompts once redaction removed enough context. Other teams building similar tools have reported comparable drops.
Mutation tries to keep the upside of both. The sensitive value never leaves the machine, but the model still gets something coherent to work with, a stand-in that looks and behaves like real data without being real data. The trade-off is that it needs something running locally to do the swap and the reversal, which is a heavier lift than a policy memo.
Where Pretense fits
Pretense is a local proxy that sits between a developer and the AI tools they already use. It applies the mutation approach described above: sensitive values get swapped for realistic stand-ins before a prompt leaves the machine, and is restored in the response.
It's designed for SOC 2, ISO 27001, and HIPAA workflows, with both certifications currently in progress rather than complete.
It's one option among several, not the only way to approach this problem. Teams that need account-level enterprise settings, secret scanning at the commit level, or a straightforward blocking policy might be well served by those instead, or alongside it. The right answer depends on what's actually leaking and where.
