How do you block personal Claude, ChatGPT, Copilot, and Cursor accounts on work laptops?

How do you block personal Claude, ChatGPT, Copilot, and Cursor accounts on work laptops?

To block personal AI accounts on work laptops, apply each vendor's tenant restriction from your secure web gateway (SWG) or mobile device management (MDM). For Claude and ChatGPT, a TLS-inspecting proxy overwrites the anthropic-allowed-org-ids or ChatGPT-Allowed-Workspace-Id header, and local Codex requirements also pin the Codex sign-in. For Copilot, a firewall allows the Business or Enterprise hostnames and blocks the individual one, and for Cursor, MDM sets AllowedTeamId. A hostname allowlist doesn't work, because personal and enterprise tiers use the same domains.

Shadow AI is the use of AI tools that your organization hasn't approved and can't see. In engineering teams, a common form is a personal account in an approved tool. A developer who hits a seat limit, wants a different model, or starts a side project signs in to the same app with a personal login. The traffic looks like any other request to the vendor, and none of your enterprise controls apply to it: no managed settings (the agent configuration that an administrator installs), no hooks, and no audit feed.

Blocking the personal path is the job of your network and device tooling, which applies the vendor controls in this guide. Arcjet coding agent hooks govern what remains. Once personal accounts are refused, every session on a managed device runs under your Arcjet policy, decided before each tool call runs, and appears in the Arcjet Console. One policy covers Claude Code, GitHub Copilot, OpenAI Codex, and Cursor.

This guide covers why the controls on your approved tenant can't see personal sessions, the vendor control that refuses each one, and how the vendor controls and Arcjet fit together. It follows the Arcjet guide to blocking personal accounts. For the rest of the coding agent control set, see coding agent security.

Why can't hooks or audit feeds see personal accounts?

Coding agent hooks and vendor audit feeds are configured on your organization's tenant, which is its account with the vendor. A hook is a call that the agent makes to a policy service before it acts, and the hook entry lives in managed settings that the approved client loads. The Claude Compliance API reports on your Claude organization. Both cover only sessions that authenticate to that tenant.

A personal account authenticates somewhere else. It doesn't load your managed settings, so it fires no hook you installed, and its activity goes to the vendor under the personal account, not to your Compliance feed. Personal use on the same network leaves no transcript and no policy decision, which is what makes it shadow AI.

You also can't separate the two at the DNS or hostname level. Personal and enterprise sessions use the same product domains, such as claude.ai and chatgpt.com. Blocking the domain blocks the approved tool as well. The vendors instead offer controls that work on the account or tenant: a header the vendor reads, a plan-specific hostname, or a device policy.

Which control blocks each vendor's personal accounts?

The following table lists the control for each agent. When the control is a header, overwrite it; don't append a second copy.

The following sections describe each control.

How do you block personal Claude accounts?

Anthropic Tenant Restrictions refuse any organization that isn't on your allowlist, including personal accounts. The restriction covers web sessions, the desktop app, API keys, and OAuth tokens, so it reaches Claude Code as well as claude.ai.

A TLS-inspecting proxy overwrites this header on the four Claude domains:

1
anthropic-allowed-org-ids: ORG_UUID

Replace ORG_UUID with your Claude organization UUID. For more than one organization, join UUIDs with commas and no spaces.

You need a Claude Enterprise plan or a Claude Console organization, TLS decryption on for those domains, and traffic going through the SWG. Cloudflare Gateway, Zscaler ZIA, Netskope, Prisma Access, Cato, FortiGate, and FortiSASE can all insert the header; any HTTPS proxy that can overwrite headers works. If the proxy appends a second value, Anthropic returns 400.

A personal key or personal sign-in on the restricted network receives 403 with tenant_restriction_violation. On Netskope, the refusal is Anthropic's 403, so Skope IT may show no block event.

How do you block personal ChatGPT accounts in Codex?

Codex signs in with a ChatGPT workspace or an API key. Personal ChatGPT and an unmanaged API organization both bypass your approved workspace, so you need two controls.

On the network, overwrite this header on https://chatgpt.com/*:

1
ChatGPT-Allowed-Workspace-Id: WORKSPACE_UUID

Replace WORKSPACE_UUID with your ChatGPT Enterprise or Team workspace UUID. ChatGPT filters out any workspace that isn't listed, including personal workspaces, and a user with no remaining workspace receives 403. TLS decryption must be on for chatgpt.com. The header doesn't apply to api.openai.com, so an API key still reaches the Platform API.

On the device, pin the sign-in in /etc/codex/requirements.toml, %ProgramData%\OpenAI\Codex\requirements.toml on Windows, or macOS MDM com.openai.codex:requirements_toml_base64. Cloud-managed requirements ignore these keys, so they must be local:

1
allowed_login_methods = ["chatgpt"]
2
allowed_chatgpt_workspaces = ["WORKSPACE_UUID"]

Codex then refuses ChatGPT sign-in outside that workspace. If you also permit api in allowed_login_methods, an API key remains a way around the pin, so leave it out unless a CI host needs it.

How do you block personal GitHub Copilot accounts?

GitHub routes Copilot traffic to a hostname that matches the user's plan. On the managed network, allow *.business.githubcopilot.com, *.enterprise.githubcopilot.com, or both. Keep the rest of the GitHub Copilot allowlist open, and block *.individual.githubcopilot.com. That stops Copilot Pro, Pro+, Max, and Free. The routing covers inline suggestions, Copilot Chat, GitHub Mobile, and Copilot CLI on recent client builds.

If you use Enterprise Managed Users on GitHub.com, you can also enable enterprise access restrictions and overwrite sec-GitHub-allowed-enterprise with your enterprise ID on github.com, api.github.com, and *.githubcopilot.com. A personal account or token then receives 403. This doesn't replace plan-based routing, and it doesn't cover SSH, Codespaces, or GitHub Pages.

How do you block personal Cursor accounts?

Cursor has no tenant-restriction header, and Cursor asks you to exclude its domains from SSL inspection. The control is on the device instead. With a Cursor Enterprise team and an MDM channel such as Jamf, Intune, Group Policy, or Linux policy JSON, set AllowedTeamId to your team ID. Cursor signs out any other team, and a personal login can't retry until an allowed team is used.

AllowedTeamId governs editor sign-in. A Cursor CLI session that uses CURSOR_API_KEY is a separate credential path.

How do you combine device, network, and hook controls?

No single control covers every path, so combine them:

1. Device management. MDM pushes managed agent settings and hooks, the Cursor AllowedTeamId policy, and the Codex login pin. It also decides who has local administrator rights, which is who can remove managed files.
2. Network. The SWG overwrites the Claude and ChatGPT headers and routes Copilot by plan. This refuses personal sessions on the managed path.
3. Arcjet hooks on the approved client. With personal accounts refused, the sessions that remain are the ones your hooks control. Arcjet enforces one set of policies across Claude Code, Copilot, Codex, and Cursor before each tool call runs, and MDM installs the hooks through managed settings, so developers can't remove them without administrator access. For each agent, see Claude Code, GitHub Copilot, Codex, and Cursor.
4. Reconciliation in the Arcjet Console. A hook controls one client, not one person. A repository-level hook can be deleted, and a developer calling the API from another tool is outside all of it. Export OpenTelemetry or connect the Claude Compliance API to a separate Arcjet site for visibility into sessions the hooks don't reach, then look for sessions that have no hook decisions. For the ingest paths, see Observe agent activity.

How do you cover what these controls miss?

The vendor controls apply on the managed network, endpoint agent, or MDM enrollment. Cover the following cases as described:

• Personal devices. A personal device off the managed network, often called bring your own device (BYOD), is outside all of these controls. Keep work on managed devices.
• API keys. Codex API keys and Cursor CLI API keys can bypass a ChatGPT workspace header or a Cursor team login. Pin login methods on the device, or treat those keys as a separate allowlist.
• Refused attempts. When the vendor refuses a personal session, it stops the request before any agent runs, so the attempt reaches neither Arcjet nor your audit feed. Your network tooling holds the record of the attempt, and some gateways, such as Netskope for Claude, don't log a block event.
• Compliance API scope. Anthropic's Claude Compliance API doesn't include Claude Code authenticated with a Console API key or run through Amazon Bedrock, Google Vertex AI, or Microsoft Foundry. Pair it with OpenTelemetry export for those sessions.

Where does Arcjet fit in stopping shadow AI?

Vendor tenant restrictions keep personal accounts off the managed path. Arcjet makes the approved sessions that remain governed and visible: each one runs under your policy and appears in the Arcjet Console. The following capabilities apply:

• One policy across Claude Code, GitHub Copilot, OpenAI Codex, and Cursor, decided before each tool call runs from the hooks the agents already fire.
• Hooks installed through managed settings or MDM, so developers can't remove them without administrator access.
• OpenTelemetry and the Claude Compliance API for visibility into sessions the hooks don't reach, so you can find sessions without hook decisions.
• Every session and decision in the Arcjet Console, with export to Datadog, Splunk, SentinelOne, Panther, and Amazon S3 (Enterprise plan) for detection and alerting.

To get started, follow the guide to blocking personal accounts for the vendor controls. Then install hooks with the per-agent guide for Claude Code, Copilot, Codex, or Cursor, and publish the coding-agent.credential-access starter policy in dry run.