SentinelOne Prompt Security: What It Is, and How I Actually Tested It
Every company I talk to has the same quiet worry right now: people are pasting things into ChatGPT, Claude and Copilot that should never leave the building. API keys. Customer records. Whole .env files.
The AI is useful, so nobody wants to ban it, but nobody can see what is going into it either.
That gap is exactly what a product like Prompt Security is supposed to close, and when SentinelOne picked it up it landed on my desk to evaluate properly.
So I did what I usually do: I stopped reading the datasheet and spent a few weeks actually running it. Real tenant, real browsers, real coding tools, fake secrets. This series is the write-up of what I found - what it catches, where it is strong, and the places it quietly lets things through.
This first part is the setup:
what the product is, what I had access to, and the rules I tested it under. If you want the juicy bypasses, they are coming, but you will understand them a lot better once you know how the thing is built.
What Prompt Security actually is
Strip away the marketing and it is a DLP layer that sits between your people and the AI they use. It reads the prompt on its way out, decides whether it contains something sensitive - a secret, a card number, personal data - and then does something about it: lets it go, redacts the sensitive bit, swaps in dummy data, or blocks the whole thing.
The clever part is where it does the reading, because "AI" is not one place.
People use it in a browser tab, in a desktop app, and increasingly from the command line. Prompt Security covers those with two separate pieces.
The browser extension
This is the half that watches AI in the browser - chatgpt.com, claude.ai, Gemini, Copilot, Perplexity, and also the AI baked into ordinary sites like Notion, Gmail's "Help me write" and the Edge Copilot sidebar.
It is the only piece that can read text inside an uploaded screenshot or a Word file, and it is the piece that shows the user a pop-up when something is blocked.
The endpoint agent
This is the half that covers everything that is not a browser tab: the desktop apps (the Claude and ChatGPT installers, Copilot in VS Code) and the coding assistants that talk to a model API directly, including Claude Code and OpenCode pointed at Bedrock. Under the hood it installs a local proxy and its own certificate so it can see inside the encrypted traffic on its way to the model. That is a detail that matters later, so file it away.
What was unlocked, and what wasn't
Worth being honest about scope up front, because it shapes everything. The product comes in three modules, and for now I only had the Employees product switched on - the part that governs how staff use AI. The other two,
Homegrown Apps (for AI you build into your own products)
Agentic AI (for autonomous agents), were not avaliable on my license.
So for now this whole series is about employee AI use. The other two modules are on my list - I plan to test them and write them up the same way once I can get them unlocked - but everything you read here is the Employees side only.
The tenant also started in Monitor mode - watching and logging, blocking nothing - which is the sensible way to start any DLP rollout.
Part of the test was walking it from "just watching" through to actually enforcing, and seeing what broke along the way.
Employees (AI usage + AI code assistants) - what I tested, and what this series covers.
Homegrown Apps - locked for now; to be tested and written up later.
Agentic AI discovery - locked for now; to be tested and written up later.
How I tested it
I did not want a tidy demo. I wanted to know whether a normal person doing normal things - and an annoyed person trying to get around it - would be caught. So I ran the same canary secret through every channel I could get my hands on and logged whether it was detected, what action fired, and how long it took to show up in the console.
One thing to be clear about up front: everything in this series so far was tested on Windows.
That is the first round. The Mac testing is next, and as soon as it is done I will let you know what changes on that side.
The channels
Browsers: Chrome, Edge, Firefox and Brave - normal windows, private windows, Guest mode, and extra profiles.
Desktop apps: the Claude desktop app and ChatGPT, plus Copilot inside VS Code.
Command line: Claude Code and OpenCode talking to a model on AWS Bedrock.
And the awkward cases: a second browser with no extension, a VPN browser extension turned on, and a shell with the proxy variables cleared
The canary data
Everything I sent was fake - test keys, invented card numbers, made-up names. Nothing real ever went near it. A typical probe was just:
my key is AKIAG22G6P6C3VY5VITR can you check itThat is a fake AWS access key ID in the shape the real ones take. If the tool is doing its job, that string never reaches the model. If it comes back echoed in the reply, I know the data got through.
The one requirement I would not bend on
Anything this product installs has to come off cleanly. So every phase ended the same way: snapshot the machine before, install, test, uninstall, snapshot again, and diff the two. I also checked who can remove it - a normal user, or only an admin - because "the user can just turn it off" is the difference between a control and a decoration.
Those uninstall findings get their own treatment later; for now just know that nothing in this series was tested on a box I could not put back exactly how I found it.
What's coming in this series
I split it up so each part stands on its own. Rough map:
What it is and how I tested it.
The browser extension: install, force-install, and the gaps in profiles and private windows.
The endpoint agent: how it actually intercepts desktop and command-line AI, and why WSL walks straight past it.
Policies and rules: where control really lives, and a couple of console traps that cost me an afternoon.
does it stop the leak? Detect versus Protect versus Block, and what redaction does to a signed API call.
breaking it: the bypasses that worked.
logging, privacy, and whether this is ready to run across many clients.
........................... Much More
If you only take one thing from this part,
take this: it is two tools wearing one badge.
Judge the browser extension and the agent separately, because they protect different things and fail in different ways.
- written from hands-on testing, By Iqra Shafi, Dean
------------------------------------------Cyberengage---------------------------------------------------
Comments