AI agents as insider risks: how agents leak data and where DLP, IRM, and watermarking fit

In October, Microsoft described AI agents as “agentic insiders.” Proofpoint, announcing its agreement to acquire Varonis, said AI agents are increasingly accessing sensitive information and taking action across systems. It’s a useful way to think about them. An agent that can read someone’s inbox, open their files and send messages on their behalf holds much the same access an employee does. As Microsoft notes, that doesn’t make agents malicious, but it does mean they can make mistakes, be manipulated or be compromised.

That exposure is likely to grow. Every task handed to an agent, from drafting client emails to preparing board updates, puts confidential information and intellectual property in the hands of something that can leak it. As agents take on more of that work, leaks involving AI are likely to become a more common part of insider risk.

Most insider-risk technology was designed around people: how they behave, which channels they use and what they tend to take with them. Agents don’t fit that model neatly, so it’s worth looking at how they leak differently and where today’s tools hold up.

Why do agents leak differently than people do?

Three differences shape how an agent leak happens, and each one opens its own paths for confidential information to get out.

1. Agents can’t be relied on to know what’s confidential. An employee knows the board deck shouldn’t be sent to a contractor, even when nothing technically blocks them. An agent works from its permissions, its instructions and whatever labels it can read. Unless a rule says otherwise, it may treat anything it can reach as fair game. In practice, that can mean an agent sending a draft to a contact with a similar name, replying to a thread that includes an outside party, or posting an update into a channel, shared folder or ticket that includes guests or partners.
2. Agents can be steered by what they read. Instructions hidden in an email, web page or file can change what an agent does next, a technique known as prompt injection. A person usually wouldn’t see the hidden text, or wouldn’t treat it as an instruction if they did. An agent may follow it, forwarding or summarizing something to an address an attacker controls. A related risk is outright compromise: someone who gains control of an agent, or of the credentials it uses, inherits everything it can read and send.
3. Agents often create new content rather than copy it. A person who leaks typically forwards, downloads, or photographs an existing document. An agent’s work generally involves summarizing, rewriting, and combining sources, so confidential material can leave inside a new message that doesn’t resemble any original file. That’s how a briefing for a team or a client ends up quoting a document the agent could reach but the audience shouldn’t see. This makes agent leaks harder for controls that look for known files, though not out of reach. Limiting what an agent can draw from narrows what can end up in its output.

Once an agent has delivered something to the wrong person, that person can forward it, screenshot it, or photograph it like any other content. And because many agent leaks look like ordinary work, they rarely raise an alarm in the moment. Most of the controls organizations already rely on still apply to agents. What matters is knowing where each one helps and where it needs support.

Where do today’s insider-risk tools help, and where do they stop?

Agents often can send through the same email, file-sharing, and collaboration channels people use, so the controls organizations already have in those channels can extend to agent activity. Four approaches carry most of the load:

• Information rights management (IRM) and access controls
• Data loss prevention (DLP)
• Security information and event management (SIEM) with behavioral analytics
• Invisible forensic watermarking

Each covers part of the problem, and each has blind spots that look different when the insider is an agent.

IRM and access controls
Scoping what an agent can read is the most direct way to limit what it can leak. Tight permissions can prevent overly broad summaries, keep confidential material out of new content, and limit what a compromised agent can reach. Access controls on a channel, folder, or ticket are also the main defense against an agent posting to a shared space that includes outsiders, and rights management can keep a forwarded file protected after it leaves. After a leak, these controls provide an access trail showing which people and agents could reach the content. When agents have their own identities, their actions can be traced back to them the same way a person’s can.

The blind spot is anything an agent was permitted to read and then sent somewhere it shouldn’t go. Most misdirected sends and in-policy posts to spaces with guests fall into that gap. Rights management also stops at the screen, because a screenshot or photo of a protected file carries none of its protections.

DLP
DLP blocks or flags content that matches a policy as it moves through monitored channels, such as a labeled file attached to an email for an external domain. It does this whether a person or an agent sends it. That makes it a meaningful check on misdirected sends and on agents following planted instructions, as long as the content looks like something a policy recognizes. After a leak, it provides a log of what was blocked and what was allowed.

Its blind spots line up closely with how agents work. Summaries and rewrites can be harder to match against a policy, even for classifiers that look at meaning rather than exact patterns. DLP is reliable when the source is labeled and quoted closely, but information is often unlabeled or mislabeled. DLP also can’t see a screenshot or photo taken after delivery.

SIEM and behavioral analytics
These tools flag activity that departs sharply from normal, which is how a compromised or manipulated agent may show up, for example as a sudden run of unusual sends after it processes an email carrying planted instructions. After a leak, risk scores and activity timelines help reconstruct what happened.

The blind spot is the quiet mistake. A single misdirected send that stays within policy looks like ordinary work. Some platforms are starting to assess agent risk on its own terms, but a single in-policy error rarely stands out.

Invisible forensic watermarking
Forensic watermarking embeds invisible, individualized watermarks in each recipient’s copy of content. This is different from the AI provenance watermarks some model providers apply, which indicate only that a model generated some content, not who received it. When forensically marked content leaks, the artifact itself can identify whose copy it was, whether it surfaces as a forwarded message, a screenshot or a photo. That holds for misdirected sends, sends triggered by planted instructions, and whatever a recipient does with the content downstream. For a compromised agent, attribution points to the copy that leaked, and the send record shows which agent to shut down.

The blind spots are content sent through a channel where marking isn’t in place, leaks that never surface where they can be found, and leaks that carry too little marked text to attribute with confidence. That last group includes very short excerpts, verbal retellings, and a recipient’s own heavily condensed summary of a marked copy.

Taken together, the preventive controls handle the cases where content looks sensitive or goes somewhere obviously wrong. The agent leaks that get through are the ones where permitted content reaches the wrong person in a form no rule recognized, which is where attribution matters most.

Where does EchoMark fit in a layered approach to AI agents?

Using AI securely takes the same layered approach that works for people. That means scoping what each agent can access, applying DLP and monitoring to the channels it sends through, and watching for behavior that suggests manipulation or compromise. Together, those controls may stop much of what shouldn’t go out. The last layer is knowing the source when something slips through anyway. EchoMark works at both ends of that stack: it controls who can access shared information, and it attributes leaks when they happen. For more details about how forensic watermarking sits alongside DLP, see our comparison of invisible watermarking, visible watermarking, and DLP.

EchoMark File Share handles the access side. Share links can be limited to a specific audience, set to expire, given a session timeout and restricted from downloading, and copy and paste is turned off by default. Access to a shared collection can be revoked. If a link reaches the wrong person, for example through an agent’s misdirected send, those controls limit what that person can open, and the activity history shows who viewed what. Each recipient sees their own forensically watermarked copy, so the access controls and the attribution work together.

EchoMark embeds invisible, individualized watermarks throughout each recipient’s copy of the information it protects: emails sent with EchoMark Email, files shared through EchoMark File Share, what appears on screens protected by EchoMark Screen, and content accessed through the EchoMark API. An AI agent that sends email or shares files through those channels gets the same treatment as a person, so each recipient’s copy is marked. If one of those copies leaks, whether as a forwarded message, a screenshot or a photo, EchoMark identifies whose copy it was, and the activity record shows which agent sent or shared it. Instead of investigating everyone who had access, the team can contain the leak, fix that agent’s permissions or instructions, and keep the rest of the program running. That’s what lets organizations expand their use of agents with confidence rather than pulling back after the first incident.

Schedule a demo to see how EchoMark controls access to, marks and attributes what your AI agents send.

-----

Frequently asked questions

1. Can AI agents leak confidential information?
   Yes. An agent with access to email, files or collaboration tools can send confidential material to the wrong person through a misdirected send, a post to a shared space with outside guests, or instructions hidden in content it reads. Most agent leaks are mistakes rather than malice, but the exposure is the same.
2. Does DLP stop AI agents from leaking data?
   Partly. DLP checks agent sends the same way it checks a person’s, and it works well when content is labeled and quoted closely. It has a harder time with summaries and rewrites, with unlabeled information, and with screenshots or photos taken after delivery.
3. How do you find out which AI agent leaked a document?
   Access logs and agent identities show which agents could reach the content. If each recipient’s copy carried an individualized forensic watermark, a leaked copy shows whose copy it was, and the send record shows which agent sent it.
4. What is prompt injection, and how does it cause leaks?
   Prompt injection is when instructions hidden in an email, web page or file change what an AI agent does next. An agent that follows them may forward or summarize confidential information to an address an attacker controls, without anyone noticing at the time.