What leaks, and the guardrail that stops it.
One profile per AI app: what actually leaves the device through it, the 27 guardrail rules that cover it, and what the vendor does with whatever gets through.
Block and Mask run inline on the request, on the device, before the bytes leave it. Everything after that point is alerting, because no product can un-send a prompt.
Alectura intercepts only tools it has been tested against. Everything else is discovered, meaning you get the app, the devices running it and how often, but the content is never decrypted, so content rules cannot run on it yet. Inline enforcement ships today for ChatGPT, Claude, Google Gemini; every other app here is discovered while its inspection support is built.
AI assistant
- ChatGPTOpenAI
The default shadow AI app, and the one most likely to be running on a personal account before anyone buys a workspace.
Inline enforcement · 27 rules
- ClaudeAnthropic
Anthropic’s assistant, and the one most likely to arrive alongside Claude Code. That changes the exposure from what people paste to what an agent reads on its own.
Inline enforcement · 27 rules
- Google GeminiGoogle
Reaches most fleets without anyone installing anything, because it is attached to accounts staff already have. The consumer and Workspace tiers have very different terms.
Inline enforcement · 27 rules
- Microsoft CopilotMicrosoft
Two products behind one name: the consumer web app, and Copilot with enterprise data protection, which is what an Entra sign-in gets you.
Discovery today · 27 rules once inspected
- DeepSeekDeepSeek
Strong models, a free tier, and a privacy policy that puts the data somewhere most enterprise policies already exclude. That makes it the clearest finding in most fleets.
Discovery today · 27 rules once inspected
- GrokxAI
Bundled with X subscriptions, so it lands on devices through a consumer account rather than any procurement path.
Discovery today · 27 rules once inspected
- Meta AIMeta
Reached through accounts staff already hold, and interactions feed the same personalisation machinery as the rest of Meta’s products.
Discovery today · 27 rules once inspected
- Le ChatMistral AI
The assistant EU teams reach for when data residency decides it, which makes it a sanctioned alternative more often than a shadow AI finding.
Discovery today · 27 rules once inspected
Code assistant
- GitHub CopilotGitHub
The most widely deployed code assistant, and usually already sanctioned. That makes what it sends, rather than whether it is allowed, the question to ask.
Discovery today · 27 rules once inspected
- CursorAnysphere
An editor rather than a plugin, and increasingly an agent, so the interesting traffic is what it decides to read rather than what the developer typed.
Discovery today · 27 rules once inspected
- WindsurfWindsurf (formerly Codeium)
Still calls home to the Codeium hostname after the rename, which is why blocklists written against the new brand name miss it.
Discovery today · 27 rules once inspected
The guardrail catalog: all 27 rules
Every rule applies to every app in this directory. Each profile calls out the handful that matter most for that app; this is the whole set, with the action each ships with.
Input secrets
- No secrets in inputMask
- Block private keysBlock
- No cloud credentialsBlock
Sensitive content
- Denied topicsAlert
- Internal host / URL leakAlert
- PII in input (basic)Alert
- Classified document markersAlert
Prompt integrity
- Prompt injection / instruction overrideAlert
- Latent & persistent instructionsAlert
- System prompt & tool enumeration probesAlert
- Invisible & bidi control charactersAlert
- Chat-template & special-token injectionAlert
- ANSI escape injectionAlert
- Content addressed to the AIAlert
Agent actions
- Destructive shell commandsAlert
- Credential file accessAlert
- Sensitive path accessAlert
- MCP tool denylistBlock
- Reverse shells & pipe-to-shell executionAlert
- AI agent config access & safety bypassAlert
- MCP tool allowlistAlert
Model output
- Secrets in model outputMask
- Sensitive data from toolsAlert
- Secrets in model reasoningAlert
- Markdown image exfil sinkAlert
- Deceptive links in model outputAlert
Observability
- Model refusalsAlert
Every rule named on these pages is a real entry in the Alectura guardrail catalog, with the action it ships with. Vendor claims are summarised from published documentation and carry the date they were last checked. Confirm against the linked sources before you write policy around a profile.