Prevent Data Leak to Shadow AI
AI code security is the set of practices and tools that keep source code, credentials, and customer data inside a company while developers use AI coding assistants like ChatGPT, Copilot, Cursor, and Claude Code. It became its own category once teams realized that firewalls and email scanners had always watched other channels, while developers moved their daily work into one new channel: the prompt box.
Most companies still treat this as a policy problem. Write a rule, tell people to keep secrets out of prompts, move on. That approach assumes engineers read policy docs at 2am when they're trying to ship a fix. So the leak keeps happening, quietly, one prompt at a time.
What AI code security means
At its simplest, AI code security covers everything that keeps sensitive code and data under company control and visibility on its way to a third-party model.
That includes account settings, network-level filtering, secret scanning, and a newer approach called mutation, where sensitive values get swapped for realistic stand-ins before a prompt leaves the developer's machine.
At Pretense, we use the mutation approach, which replaces sensitive identifiers like API keys with deterministic, semantically equivalent synthetic identifiers in place of simple redaction.
Why AI Code Security became its own Category in 2026
AI coding tools went from novelty to default, with most professional developers using one regularly, according to the Stack Overflow 2025 Developer Survey. And the tools built to stop data loss, the DLP and CASB products companies already owned, were built for email attachments and file uploads.
They still need an update for a text box that accepts anything, including a full file of production code pasted by hand.
The gap between those two facts is where this category lives. Security teams noticed traffic hidden from their view. Engineering teams noticed traffic they wanted to keep.
AI code security is the attempt to reconcile both.
There's also a generational shift underneath this. A decade of security investment went into the perimeter: firewalls, endpoint agents, network segmentation. That investment assumed the dangerous action was a file moving across a boundary.
AI coding tools broke that assumption quietly, because the boundary a browser tab crosses looks like normal work. An engineer opening a new tab to ask a question raises zero alarms.
How code and secrets leak to AI tools
There are four code and api key leak paths to ai tools and most companies only have eyes on the first one.
- -
Chat pastes. An engineer copies a function, a config file, or a stack trace into ChatGPT or Claude to get help. This is the most visible path and the easiest to picture, which is probably why it gets the most attention. It's also often the smallest slice of actual exposure.
- -
IDE assistants. Copilot, Cursor, and similar tools read open files and surrounding context automatically, with zero explicit pasting. A developer working in a file with a hardcoded API key can do everything right and still share it. The assistant already has it in context.
- -
CLI agents. Command-line coding agents can read entire directories, run scripts, and pull in whatever files sit next to the one being edited. The blast radius here is larger than a single paste because the agent decides what's relevant, while the human watches.
- -
Autocomplete. Inline suggestions send fragments of the surrounding file to a model on nearly every keystroke in some tools. It's continuous, it's invisible, and almost everyone forgets to audit it.
To be honest, everyone on that list of four paths is trying to get work done. An engineer pasting a stack trace at midnight is trying to ship a fix before an on-call shift ends.
A CLI agent pulling in three neighboring files is doing exactly what it was designed to do: gather context to give a better answer. The leak is less a failure of judgment and more a mismatch between how these tools were built to be helpful and how little visibility that helpfulness leaves behind.
That mismatch also explains why blocking alone rarely holds up over time. An engineer who genuinely needs an AI tool to debug a production issue at 2am, and finds it blocked, will generally find a way around the block sooner than wait for a ticket to be resolved. The need stays. Only the visibility into how that need gets met goes away.
The number that gets cited most often comes from IBM's Cost of a Data Breach 2025 report: unsanctioned AI use added roughly $670,000 to the average cost of a breach.
The same report found that one in five breaches now involves an AI tool that skipped approval, and that 97 percent of AI-related breaches happened while access controls were entirely absent.
Approaches to protection, compared
Three approaches dominate right now, and they trade off differently.
| Approach | What it does | Where it breaks down |
|---|---|---|
| Blocking | Stops the prompt from being sent at all | Engineers route around it or stop reporting it |
| Redaction | Strips sensitive fields before sending | The model loses context and accuracy drops |
| Mutation | Swaps sensitive values for realistic stand-ins; swaps code identifiers back in the response while secrets stay as stand-ins | Requires a local agent to run correctly |
Blocking is the blunt instrument. It works until an engineer needs the tool to do their job, at which point they find a way around it, usually one that's harder to see than the thing you tried to stop.
Redaction is more thoughtful but has a real cost. Strip out the patient ID, the variable name, the connection string, and the model is left guessing at what used to be there.
In our own testing at Pretense, accuracy degraded by 20 to 30 percent over a few prompts once redaction removed enough context. Other teams building similar tools have reported comparable drops.
Mutation tries to keep the upside of both. The sensitive value stays on the machine, and the model still gets something coherent to work with, a stand-in that looks and behaves like real data while staying synthetic. The trade-off is that it needs something running locally to do the swap and the reversal, which is a heavier lift than a policy memo.
Where Pretense fits
Pretense is a local proxy that sits between a developer and the AI tools they already use. It applies the mutation approach described above: sensitive values get swapped for realistic stand-ins before a prompt leaves the machine. Code identifiers are swapped back byte-exact in the response, and secrets stay as stand-ins by design, so a prompt-injected model has only a placeholder to exfiltrate.
It's designed to support SOC 2, ISO 27001, and HIPAA programs, with both certifications currently in progress.
It's one option among several, and other paths can fit this problem too. Teams that need account-level enterprise settings, secret scanning at the commit level, or a straightforward blocking policy might be well served by those, on their own or alongside it. The right answer depends on what's actually leaking and where.
