Coverage and limits
Exactly which prompts shim checks today, what it cannot see, and what is still being validated.
On this page
shim checks what people type into recognized AI composers in managed browsers, and the files they attach. It does not see everything that leaves a device, and it says so wherever coverage matters.
What shim checks
On those origins, shim checks prompts and attached files in Chrome and Edge version 140 or later, on browsers where the extension is installed and enrolled.
Detection covers credentials in nine formats (GitHub, OpenAI, AWS, Google API, Slack and Stripe keys, JSON Web Tokens and private key blocks), ASCII email addresses, payment card numbers, IBANs, Turkish national ID numbers (TCKN) and the confidential terms you list, with *, ? and # wildcards. The rule categories list exactly what each one matches. Prompts can be up to 32,000 characters; a longer prompt in a recognized composer cannot be checked and is not sent.
Card, IBAN and national ID detection checks the format and check digits, so other numbers that happen to pass are flagged too. In a test on 21 October 2026, of 20,000 synthetic English and Turkish prompts that include order, tracking and account numbers and other IDs, shim flagged 0.540% as containing a card number, 0.155% a national ID number and none an IBAN, credential or email address. Synthetic prompts are not your organization’s data; try a policy on your own samples with Try this policy.
AI apps shim notes
shim does not check prompts in other AI apps, and it does not block them. When a browser’s policy turns on AI app discovery, the browser notes which of these it has open on each day, for the console’s AI apps page:
| AI app | Sites, with their subdomains |
|---|---|
| ChatGPT, Claude, Gemini and Grok | The origins above |
| Perplexity | perplexity.ai |
| Microsoft Copilot | copilot.microsoft.com, copilot.cloud.microsoft |
| DeepSeek | chat.deepseek.com |
| Le Chat | chat.mistral.ai |
| Meta AI | meta.ai |
| Poe | poe.com |
| Qwen | chat.qwen.ai |
| Kimi | kimi.com |
| NotebookLM | notebooklm.google.com |
| Google AI Studio | aistudio.google.com |
Copilot inside Edge’s sidebar or Office apps, and AI apps reached through another site’s address, are not noted. What each record holds, how to label an app and how to block one with a browser policy are in AI apps.
Files
shim checks files when they are attached, dropped or pasted, before the AI site can upload them: PDF (including Chinese, Japanese and Korean text), Word, Excel, PowerPoint, OpenDocument, RTF and plain-text files up to 32 MB. Document properties, comments, hidden fields and other text that isn’t on the page are checked too, with exceptions that are not checked yet, including spreadsheet headers, footers, sheet names, table columns and connection strings, PowerPoint section names and tags, OpenDocument form values, macros and presentation footers, link targets, tooltips, list options and comment authors. A value that formatting splits, encodes or runs into neighboring text can also be missed. Some valid documents, such as signed, macro-enabled or legacy-encoded ones, are kept out because they can’t be fully checked. Text inside images is not read, and dynamic XFA forms are kept out because their form data can’t be checked. A test on 21 October 2026 with 677 synthetic files confirmed each of these gaps. A flagged plain-text file can be attached as a masked copy; other file types can’t be masked. File inspection is limited to 2,000 pages and 8 million extracted characters. Long text pasted into Claude, which Claude turns into a Pasted text attachment, is checked when it is pasted and is kept out above 32 MB or 8 million characters. A message can carry the files and pasted text shim checked on that page. Administrators see what was flagged in each file and where, never the whole file. Long paths within a document are shortened with an ellipsis. The browser also blocks each AI site’s file uploads, except in a tab for 30 seconds after shim attaches checked files there. That catches uploads that skip shim’s check through a site path shim doesn’t watch, if the site uses the upload addresses shim knows; Claude’s Take a screenshot, for example, hasn’t been checked. It doesn’t stop a page that sets out to get around shim, which can attach a clean file itself to open the 30 seconds. This is an alpha awaiting live-site validation.
Outside the current release
- Text inside images, and attachments that skip the attach check: connector imports, Grok’s Recent files and Claude screenshots
- Perplexity’s Edit query on a sent question: shim blocks it as an unsupported composer, so ask again in the message box
- Grok inside x.com
- Voice input
- Desktop and mobile applications
- Direct API calls and other tools that send prompts without a browser composer
- Browsers without the extension, and AI websites not listed above
Limit. shim matches each attachment in the composer to a file it checked by file name. Any other attachment, including one restored after a page reload, blocks Send until the employee removes it, and the notice names it. An unchecked attachment with exactly the name of a checked file is not told apart.
Composer status
The extension reports what it last saw in an AI tab. Its settings show the status below. In the console, a Degraded report marks the device Needs attention. Unsupported is also what a browser reports before it opens an AI page.
A status describes the last composer one browser observed. It is not a guarantee of coverage across every tab.
How the check works, and what it cannot do
The extension reads the draft from the page and checks it when the employee sends. This is a check inside the page, not a network filter.
Limit. A check in the page cannot intercept every network request and cannot stop a hostile page that bypasses it. shim blocks the background requests observed carrying a draft before Send is pressed: ChatGPT’s draft preparation, Grok’s typeahead and suggestions, and Perplexity’s suggestion service, so Grok and Perplexity show no autocomplete suggestions. Other network routes have not been verified.
Ready coverage means shim recognized the composer’s markup. It does not mean complete protection against data leaving the browser.
Validation status
shim is in alpha. Automated browser checks run the real extension against recorded page fixtures. They show how the extension behaves, not that every live ChatGPT, Claude, Gemini, Grok or Perplexity page version behaves the same way. These are still being validated:
- Enterprise installation, managed settings, permissions, updates, rollback and revocation
- Check latency, detection quality and false positives on your organization’s data and on the live sites; so far they are measured on synthetic prompts and files and on recorded page fixtures
- Hosting, single sign-on with live identity providers, account lifecycle, audit export and monitoring