Yeah, exactly. I'd say it borders on almost unsolvable for any agent of reasonable complexity.

You see some of the vulnerability chains humans come up with and they're just insane.

Even scanning network data for sensitive strings (say matching against a codebase or data set it works on) is tough because you can only check so granularly before you get loads of false positives.

But maybe like a "rolling" sort of check would help with that, % of outbound data matching private dataset (which should be operated on but not transmitted) over time. That way it minimises what gets out while dealing with false positives. Some biz thresholds might be >20% of data others might be >0.5%. Hmm.