Coverage and limits
Exactly which prompts shim checks today, what it cannot see, and what is still being validated.
On this page
shim checks what people type into recognized AI composers in managed browsers, and the files they attach. It does not see everything that leaves a device, and it says so wherever coverage matters.
What shim checks
| Application | Origins |
|---|---|
| ChatGPT | https://chatgpt.com, https://chat.openai.com |
| Claude | https://claude.ai |
| Gemini | https://gemini.google.com |
On those origins, shim checks prompts and attached files in Chrome and Edge version 140 or later, on browsers where the extension is installed and enrolled.
Detection covers credentials in nine formats (GitHub, OpenAI, AWS, Google API, Slack and Stripe keys, JSON Web Tokens and private key blocks), ASCII email addresses, payment card numbers, IBANs, Turkish national ID numbers (TCKN) and the confidential terms you list, with *, ? and # wildcards. The rule categories list exactly what each one matches. Prompts can be up to 32,000 characters; a longer prompt in a recognized composer cannot be checked and is not sent.
Card, IBAN and national ID detection checks the format and check digits, so other numbers that happen to pass are flagged too. On 20,000 synthetic English and Turkish prompts that include order, tracking and account numbers and other IDs, shim flagged 0.54% as containing a card number, 0.155% a national ID number and none an IBAN, credential or email address. Synthetic prompts are not your organization’s data; try a policy on your own samples with Try this policy.
AI apps shim notes
shim does not check prompts in other AI apps, and it does not block them. When a browser’s policy turns on AI app discovery, the browser notes which of these it has open on each day, for the console’s AI apps page:
| AI app | Sites, with their subdomains |
|---|---|
| ChatGPT, Claude and Gemini | The origins above |
| Microsoft Copilot | copilot.microsoft.com, copilot.cloud.microsoft |
| DeepSeek | chat.deepseek.com |
| Grok | grok.com |
| Perplexity | perplexity.ai |
| Le Chat | chat.mistral.ai |
| Meta AI | meta.ai |
| Poe | poe.com |
| Qwen | chat.qwen.ai |
| Kimi | kimi.com |
| NotebookLM | notebooklm.google.com |
| Google AI Studio | aistudio.google.com |
Copilot inside Edge’s sidebar or Office apps, and AI apps reached through another site’s address, are not noted. What each record holds, how to label an app and how to block one with a browser policy are in AI apps.
Files
shim checks files when they are attached, dropped or pasted, before the AI site can upload them: PDF (including Chinese, Japanese and Korean text), Word, Excel, PowerPoint, OpenDocument, RTF and plain-text files up to 32 MB. Document properties, comments, hidden fields and other text that isn’t on the page are checked too. Text inside images is not read, and dynamic XFA forms are kept out because their form data can’t be checked. A flagged plain-text file can be attached as a masked copy; other file types can’t be masked. Long text pasted into Claude, which Claude turns into a Pasted text attachment, is checked when it is pasted. A message can carry the files and pasted text shim checked on that page. Administrators see what was flagged in each file and where, never the whole file. This is an alpha awaiting live-site validation.
Outside the current release
- Text inside images, and attachments that skip the attach check: connector imports and Claude screenshots
- Voice input
- Desktop and mobile applications
- Direct API calls and other tools that send prompts without a browser composer
- Browsers without the extension, and AI websites not listed above
Limit. shim matches each attachment in the composer to a file it checked by file name. Any other attachment, including one restored after a page reload, blocks Send until the employee removes it, and the notice names it. An unchecked attachment with exactly the name of a checked file is not told apart.
Composer status
The extension reports what it last saw in an AI tab. Its settings show the status below. In the console, a Degraded report marks the device Needs attention. Unsupported is also what a browser reports before it opens an AI page.
| Status | Meaning |
|---|---|
| Ready | A recognized composer with its Send control |
| Empty draft | A recognized composer with nothing typed |
| Degraded | A recognized composer in a browser with no current policy (not enrolled, revoked or expired), or with text but no recognized Send control. Without a policy or a Send control, sending is blocked; an expired policy follows its offline setting |
| Unsupported | No single recognized editor, an attachment shim did not check, or a page shim cannot read, for example after a site change. Sending is blocked |
A status describes the last composer one browser observed. It is not a guarantee of coverage across every tab.
How the check works, and what it cannot do
The extension reads the draft from the page and checks it when the employee sends. This is a check inside the page, not a network filter.
Limit. A check in the page cannot intercept every network request and cannot stop a hostile page that bypasses it. shim blocks one observed ChatGPT background request that can carry a draft before Send is pressed. Other network routes have not been verified.
Ready coverage means shim recognized the composer’s markup. It does not mean complete protection against data leaving the browser.
Validation status
shim is in alpha. Automated browser checks run the real extension against recorded page fixtures. They show how the extension behaves, not that every live ChatGPT, Claude or Gemini page version behaves the same way. These are still being validated:
- Live-site flows across editor variants, locales, click and Enter, and edit races
- Enterprise installation, managed settings, permissions, updates, rollback and revocation
- Check latency, detection quality and false positives on representative data
- Hosting, single sign-on, multi-factor authentication, account lifecycle, audit export, backups and monitoring