I parsed my own firewall logs and found which AI tools my org was really talking to — including one routing data to China (opens in new tab)

I pointed a scanner I wrote at my own network traffic for one afternoon. It came back with eight AI services I'd never sanctioned, running quietly in the background. One of them was DeepSeek, which routes data to servers in China. No alert fired. No DLP rule tripped. Nothing in the stack had flagged any of it — because the traffic looked exactly like what it was: ordinary HTTPS to legitimate-looking domains. That gap — between "we have an AI policy" and "we can prove what's actually running" ...