There are plenty of AI DLP solutions out there (which is what we expected), but there is currently nothing that controls the commands an AI agent can or cannot execute, and that is fundamental.
Think about this:
An employee says to the AI Agent: "Read this document {sensitive_document.docx} and tell me what the internal policy is for XYZ." Blocking that is fine, because the organisation's information doesn't leave the perimeter. That's a good thing, and DLP handles it reasonably well.
But DLP was designed for humans moving data. It watches for files being emailed out, documents being uploaded to personal drives, sensitive strings appearing in outbound traffic, etc... it was never designed to reason about intent, context, or the downstream consequences of an instruction given to an autonomous agent.
On the other hand, if you've only got a DLP service in place, an employee could say: "Clean up my code and make sure everything is available on GitHub for my team."
Now, the AI has no way of knowing whether you mean your personal GitHub or the company's. It's very common for people to have multiple profiles, and the agent will rarely stop to ask. On top of that, saying "make sure everything is available" can nudge the AI into pushing the entire codebase, when that is almost never what the person actually intended. No data left the machine in a way DLP would flag. No policy was technically violated. And yet, your proprietary code is now sitting in a public repository.
And it doesn't stop there. Users are also very unlikely to spend much time thinking about how they word their prompts, as most people just want to get things done as fast as possible. This results in low prompt quality, which directly impacts how reliably and predictably the agent behaves. A vague instruction in an agentic context isn't just a bad output. It can trigger a chain of unintended actions that are difficult, or in some cases impossible, to roll back. The agent doesn't second-guess you. It executes.
This is the reality organisations are walking into as AI coding agents, including Claude Code, GitHub Copilot, Cursor, and others, become standard tools in the development workflow. The attack surface isn't just data exfiltration anymore. It's uncontrolled execution.
DLP will catch what leaves. It won't catch what gets done.
DarkControl's Audit Log Trail
At DarkControl, we don't do DLP. What we do is Zero-Trust Governance for AI Agents, giving organisations command-level visibility and control over what their agents can and cannot do, in real time. Every action an agent attempts passes through a policy engine: allow, deny, or ask. No blind trust. No silent execution. If you're deploying AI coding agents at scale and relying solely on DLP to keep things safe, there's a gap in your coverage that wasn't there two years ago.
We built DarkControl to close it.
