Why does classic DLP fail on ChatGPT and Claude?

Employee prompts travel over HTTPS directly to OpenAI or Anthropic. Many network DLP and email gateways never see the cleartext body. NoeticGuard Browser Shield masks PII in the page before the browser request leaves the device. Key takeaways: TLS to the LLM vendor blinds packet-level DLP. Paste and uploads happen in the browser UI, not mail gateways. Shadow AI adds new hosts faster than CASB catalogs update.

Home / Guides / why-classic-dlp-fails-on-chatgpt

Why classic DLP fails on ChatGPT and Claude browser sessions

HTTPS LLM chats bypass many network DLP controls. How on-device Browser Shield closes the employee ChatGPT/Claude gap without proxying raw prompts.

Published 2026-08-10 · NoeticGuard engineering notes

Classic DLP was built for email gateways, file shares, and sanctioned SaaS proxies. Employee ChatGPT and Claude sessions break that model.

TLS to the LLM vendor — content is encrypted end-to-end to OpenAI/Anthropic; many network appliances never see cleartext prompts.
Browser-native clients — paste and file upload happen in the page, not through your mail DLP path.
Shadow AI velocity — new models and URLs appear faster than CASB catalogs.

NoeticGuard Browser Shield runs @noeticguard/core in the page: tokens replace PII before the browser POST leaves the device. The extension calls api.noeticguard.com only for ng_pub_ config and telemetry — not to upload chat text for remote masking. Startup+ Media Guard can additionally block image/file uploads on those hosts.

Category comparison: Network DLP vs NoeticGuard.

Get started Read the docs