The weak spot is not the chatbot itself. It is the full conversation the model can interpret and the APIs the agent can use after that, which is where standard CASB and DLP controls run out of room.
The sources line up on that gap. One argues that prompts can look harmless one line at a time but still add up to sensitive context, and that risky behavior may only appear when an agent acts. The other says AI security also fails without API discovery, protection, and governance, especially when shadow and zombie APIs are still reachable.
For teams rolling out employee chatbots or agents that can read mail and documents, the control problem shifts from blocking obvious secrets to watching what the system learns and what it can do with permitted API access.