Beyond Regex: Governing Sensitive Data in AI Conversations
Abnormal, Thursday, October 22nd, 2026
Abnormal argues pattern-based DLP fails in AI chat and that governance must weigh content, context and identity together.
Abnormal says traditional data loss prevention was built for files and fields, where regular expressions can catch Social Security or credit card numbers.
AI chat breaks those assumptions because sensitive meaning often has no sensitive string and paraphrasing strips out patterns.
The post cites research such as Zenity Labs' SalesBleed attack, in which a hidden prompt led a Salesforce Agentforce agent to leak CRM data.
Abnormal argues governing AI chat requires combining content, context and identity, grading responses to risk and measuring every control.