You already think about what your coding agent can read, run, and send. Most people never apply the same scrutiny to the chat window sitting in the next browser tab — and 2026's data-loss and privacy research says that gap is wide, measured, and already showing up in breach statistics.
This is a roundup of what got measured, not a single study: DLP telemetry from inside real companies, a large consumer survey on trust, and the breach-tracking organizations counting what happens afterward.
TL;DR
| Question | What the data says |
|---|---|
| How often is something sensitive pasted into an AI tool? | Every ~3 days per employee, per DLP telemetry |
| What share of AI interactions expose sensitive data? | 39.7% |
| What share of employees use personal (unmanaged) AI accounts? | ~68% |
| Do people say they trust AI tools with their data? | No — 71% expect AI to make personal data less secure |
| Has this contributed to real breaches? | Yes — 1 in 4 breaches (Mar 2025–Feb 2026) were AI-enabled, per IBM |
| Does Beam Sentinel block any of this? | It pauses high/critical-severity matches in-browser before send; it does not stop what a chat app does with data once you accept and send it |
How much sensitive data is actually going in
The most concrete numbers come from Cyberhaven's 2026 report, built from data-loss-prevention telemetry inside real organizations rather than a survey of what people say they do. The headline figures:
- 39.7% of AI chatbot interactions expose sensitive data.
- Employees paste something sensitive into a tool like ChatGPT roughly every three days.
- 77% of employees paste data into AI tools at all, and 34.8% of everything pasted is sensitive — internal pricing models, client lists, financial statements, strategy documents, source code, personnel files, legal documents, and trade secrets are the categories the report tracks.
- ~68% of employees use free, personal AI accounts for this rather than a company-managed one, and more than half of them paste sensitive or confidential data into those sessions anyway — meaning it happens entirely outside whatever access controls or retention policy the employer thinks it has.
The organizational side of the same report: 68% of organizations have already leaked data this way, while only 23% have an AI usage policy in place at all. That gap — widespread use, rare governance — is the mechanism, not a side effect.
What the Cyberhaven page itself says
The linked Cyberhaven blog post is a short summary, dated February 11, 2026, of its 2026 AI Adoption & Risk Report. It states two of the figures above directly: 39.7 percent of all AI interactions involve sensitive data, counting prompt text, copy and paste actions and file uploads, and employees on average input sensitive data into AI tools once every three days. The other figures in the list above, including the 77 percent, 34.8 percent and the organizational percentages, are not on that summary page, so treat them as coming from the fuller report and check it before quoting them.
The summary page adds detail that matters for how the numbers are read. It reports how much usage runs through personal rather than corporate accounts, and the share differs a lot by tool: 32.3 percent of ChatGPT usage, 24.9 percent for Gemini, 58.2 percent for Claude and 60.9 percent for Perplexity. Cyberhaven's reading is that personal accounts bypass SSO enforcement, centralized logging, enterprise retention policies and controls on data usage or model training. It also says employees are not acting maliciously: AI speeds up work, and the risk comes from fast adoption meeting slow security programs. Broad attempts to block AI, it says, rarely reduce risk and instead push use outside formal controls.
On sensitive categories, Cyberhaven reports that sales and go-to-market data is a mid-teens percentage of AI-bound data globally and nearly 30 percent of what sales teams send, that research and development content dominates in industries such as healthcare at roughly a third, and that source code, internal project data and regulated information such as health records are among the technical and controlled assets involved.
Why coding agents widen the same gap
The same page has a section on agents that is directly relevant to readers of this blog. Cyberhaven says that by December 2025, 49.5 percent of developers were using coding assistants, up from approximately 20 percent at the beginning of the year, and that nearly 23 percent of organizations had adopted agent-building platforms. It describes agents as structurally riskier than a chat tab: they often have persistent context windows, local searchable memory of interactions, and direct access to file systems and clipboards. Some run at the operating-system level, bypass traditional network controls and synchronize data to infrastructure outside security oversight. In its words, this creates long-lived, high-value data exposure on endpoints.
That is a vendor's reading, from a data-security company that sells monitoring, so weigh it accordingly. It still matches the premise of this blog: a chat window is one place text leaves a machine, and an agent with file access is another, with more material available to send.
The trust paradox
What makes this data-sharing pattern notable is that it runs directly against what people say they believe. Pew Research's "Americans and AI 2026" survey (5,119 US adults, February 2026) found 49% of US adults now use AI chatbots, but only 29% trust the output, and 71% believe AI's growth will make their personal data less secure.
A separate privacy-focused survey found 88% of people say they do not freely share personal information with tools like ChatGPT or Gemini, and 90% report being worried about AI using their data without consent.
Two details change how much weight these two surveys can bear. Pew's study is a probability sample: 5,119 US adults surveyed from February 17 to 23, 2026, through its American Trends Panel, and it reports that about half of US adults now use AI chatbots, up from a third in 2024. The Malwarebytes figures are different. By its own description, the survey gathered 1,200 responses from readers of the Malwarebytes newsletter, and the company admits the sample is probably skewed toward the privacy-conscious. It also reports that 84% of respondents have not shared personal health information with AI tools and that 43% have stopped using ChatGPT. These are useful as a picture of stated attitudes among people who care, not as a measure of the general public.
This is also why the comparison with DLP telemetry is suggestive rather than conclusive. The surveys ask what people say. The telemetry counts what happened in monitored workplaces. They are different populations, and nothing here proves the same individuals hold both views, though the gap between stated caution and measured behaviour is large enough to take seriously.
Put the two data sets side by side and the picture is: distrust is high and rising, and so is the volume of sensitive material actually being typed or pasted in. Self-reported caution and measured behavior are describing two different populations of the same people.
What it's causing
Three separate tracking efforts point at the same trend line from different angles:
- AI-enabled breaches are rising. IBM's research found 1 in 4 breaches between March 2025 and February 2026 were AI-enabled — up 56% year over year.
- Breach volume is at a record pace. The Identity Theft Resource Center logged more than 471 million breach-victim notices in the first half of 2026 alone, compared with 297.5 million for all of 2025.
- The downstream harm is concrete, not abstract. Of people who received a breach notice, 88% reported at least one negative consequence — more phishing attempts, more spam or robocalls, or an attempted account takeover.
One specific case worth naming: Koi Security's investigation, published December 2025, found that "privacy" browser extensions had harvested and sold 8 million users' actual AI chatbot conversations — including names and other sensitive details — to third parties. The extension marketed as protecting your privacy was the leak.
How "privacy" extensions end up with your conversations
The mechanism behind the Koi Security case is described in The Register's report on a researcher's investigation of data brokers. People install browser extensions that promise a free VPN or ad blocking, usually without reading the privacy policy. According to the researcher, Lee S Dryburgh, such extensions can silently intercept conversations with services like ChatGPT, Gemini, Claude and DeepSeek by overriding the browser's native fetch() and XMLHttpRequest() functions, which lets them capture every prompt and every response.
Dryburgh says the captured conversations ended up in a vector database exposed through an API to authenticated customers of a platform. He reports that panelists carried pseudonymized IDs but that the conversation content was stored verbatim and searchable, and that many prompts contained real names, dates of birth, medical record numbers and diagnosis codes. He says 205 queries to the platform returned about 490 unique prompts from more than 435 panelists across 20 sensitive categories. The data aggregators insist their handling is lawful and anonymized, and The Register notes that anonymized profiles can sometimes be re-identified from a few data points. Treat these as the researcher's claims, reported by The Register, not as audited findings. The Register also reports that Koi Security documented the extension side of the practice in December 2025.
For a developer the practical lesson is narrow and checkable. A browser extension with permission to read and change pages on chat sites can see everything typed there, whatever the chat provider's own policy says. Review the extensions installed in the browser profile you use for work, remove those you do not need, and be sceptical of any that are free and ask for access to all sites.
None of this requires an exotic exploit. It's the ordinary path: paste something sensitive into a chat box, on a personal account, with no policy governing it, and multiply that by however many people do it every few days.
Where a local check actually helps
Nothing here is solved by using a "more secure" chatbot — the risk is in what leaves your machine before any provider's own data handling ever comes into play. That's the same problem Beam's local-first approach to coding agents is built around, applied to a different surface: the browser tab where a developer pastes a stack trace, a config file, or a snippet of code to get unstuck.
Beam Sentinel, Beam's browser extension, checks what you're about to send on ChatGPT, Claude, Gemini, Perplexity, Copilot, and Grok against the same 12 heuristic patterns as Beam's local collector — labeled personal data, credential references, a credential paired with an outbound destination, and similar patterns — immediately before the prompt is sent. High- and critical-severity matches pause the action and require an explicit Allow once; medium matches get a short warning; everything else goes through without interruption. The checks and any redaction happen inside the extension itself — there's no authentication step and no network request to do them, so nothing about what you typed has to leave your browser to be checked.
It's worth being precise about the limit here, the same way we are about Beam's local agent recorder: this catches what matches a known pattern before send. It does not review the meaning of what you wrote, it does not stop you from clicking through a pause, and it has no visibility into what the destination service does with your data once you do send it. For the deeper mechanics of that pattern-matching approach — and its honest false-negative rate — see MCP security: a practical guide and AI agent security: securing coding assistants, which cover the same heuristic-scanning tradeoffs applied to skills and MCP configs instead of chat prompts.
There's a second blind spot worth naming, because it follows directly from that limit: a text scanner reads text. It cannot read pixels. Screenshots and screen recordings are now an ordinary way to ask a chatbot a question — "why does this dashboard look wrong," "what's happening in this clip" — and they routinely carry faces, license plates, names on a badge, or a customer record visible in a background tab. None of that is caught by a pattern match on the prompt string, because as far as the check is concerned the prompt is an image and a sentence. If you share video or screen captures regularly, strip the identifying detail before it leaves your machine — bgblur.com blurs faces and license plates in video for exactly this reason. Same principle as everything above: remove it before send, not after.
What to do this week
The sources above support a short list of actions that do not depend on any one product:
- Find out which accounts your team uses. Cyberhaven's per-tool figures suggest the personal-account share varies widely, so a single company-wide assumption is unlikely to be right.
- Write down what may not be pasted. Credentials, customer records, regulated data and unreleased source code are the usual starting set. Cyberhaven's finding that blanket blocking pushes use out of sight is a reason to pair rules with an approved alternative.
- Audit browser extensions on machines that handle sensitive work, given the interception technique The Register describes.
- Treat agent memory and context as stored data. If your coding agent keeps local history, know where it lives and what it contains. See what AI agent monitoring is for what that history can show.
- Check before you send. A pre-send check in the browser, such as Sentinel, catches pattern matches only, as described above. How it works is covered in Beam Sentinel and browser AI assistant security.
Related reading
- OpenAI's Project Lily: what human review of ChatGPT chats means for work — the review side of this same conversation data, and why it's a preview of the bigger visibility gap at work
- Enterprise data agents are the new access-control problem — the enterprise-side version of this same exposure, via a sanctioned agent connected straight to the warehouse
- What is AI agent monitoring?
- AI agent security incidents: a timeline
- Vibe coding security: a practical checklist
- MCP security: a practical guide
Figures are as reported by the cited sources at the time of writing (Cyberhaven, Pew Research Center, IBM/CNBC, the Identity Theft Resource Center, Malwarebytes, and The Register/Koi Security). Beam Sentinel's capabilities reflect chrome-apps/beam-sentinel's README as of September 9, 2026.