The two largest institutional network operators in the United States both added generative AI tools to their filter lists this month. According to Stateline’s September 8 report, Los Angeles Unified is barring generative AI on issued devices for the 2026–27 year, and New York City has put a one-year moratorium in place — a rule the district says affects about 600,000 users.
Those are just the newest names on a much longer list. Samsung banned ChatGPT internally in 2023 after a data-leak incident. Apple restricted it around the same time. JPMorgan, Verizon, and Amazon issued similar internal guidance. Multiple US federal agencies restrict access on issued hardware. Public library systems in several states filter it under the same rule sets that filter other categories.
Under each of those decisions is the same mechanical question: how do you actually block “AI tools” on a network? The answer is more brittle than most of the coverage suggests, and worth understanding if you work with any managed network.
The block, mechanically
An IT team told to “block ChatGPT” has three levers, and they use them the same way they use them for any other target — the levers are not specific to AI. This is the same DNS / IP / DPI stack we covered in our filter explainer, applied to a new set of hostnames.
DNS filtering is the first and cheapest. The network’s resolver returns NXDOMAIN or a landing-page address for chat.openai.com, claude.ai, gemini.google.com, and so on. This is what happens on almost every enterprise Zscaler, Cisco Umbrella, or Cloudflare Gateway deployment: a filter category is enabled, and the vendor’s threat intel feed populates the domain list.
IP-level blocks are less common because most AI providers sit behind Cloudflare, Fastly, or Google’s front-end fleets, and blocking those IPs by address would break large chunks of the rest of the internet.
Deep Packet Inspection at the TLS SNI is what a serious enterprise deployment adds on top. The DPI appliance reads the destination hostname out of the TLS ClientHello and drops the connection before the handshake finishes. This is what defeats the “just change your DNS to 1.1.1.1” workaround at the enterprise perimeter.
The economics of each layer are different — DNS scales to millions of devices at almost no cost per user, DPI takes real hardware — but they all attack the same object: the hostname a device tries to reach.
Why the blocklist keeps growing (and losing)
The problem for the block operator is that the list of AI hostnames is not stable. It’s not even close to stable. A partial inventory of what a serious blocklist has to cover, as of late 2026:
- First-party interfaces:
chat.openai.com,claude.ai,gemini.google.com,copilot.microsoft.com,chat.deepseek.com,chat.mistral.ai,chat.qwen.ai,perplexity.ai,you.com,poe.com,x.ai. - API endpoints:
api.openai.com,api.anthropic.com, and equivalents. Blocking the interface without blocking the API just relocates the workflow to Postman or a curl-based script. - Third-party wrappers: Merlin, HARPA, Sider, Monica, dozens of others — each shipping a browser extension that calls one of the APIs above.
- Open-model hosts: Together, Replicate, Groq, Fireworks. These serve Llama, Mistral, and Qwen chats from their own domains.
- Community front-ends: dozens of open-source ChatGPT-alike UIs deployed by individuals on
*.vercel.app,*.pages.dev,*.hf.space.
The last category is the one no blocklist maintainer wins. Anyone can deploy a chat UI to Vercel or Cloudflare Pages in about ten minutes. The moment the deployment gets popular enough to notice, one entry gets added to the blocklist and three more spin up on adjacent subdomains. This is the same asymmetry that keeps VPN block lists growing forever — the block is defensive; the deployment is generative.
Where a browser-tab proxy fits
The reason we cover this on an AnyProxy blog is straightforward: adults who work on managed networks — corporate employees, researchers on library WiFi, travelers on hotel WiFi that flags AI destinations under the “productivity” filter category — often need to reach a page their network operator has categorised out.
A browser-tab web proxy is one honest option among several. It fetches the page from a network where the filter does not apply, and hands the rendered result back to the browser tab. The network sees an HTTPS request to anyproxy.site, not to the underlying destination.
It doesn’t defeat every layer. If the enterprise runs a TLS-terminating proxy with a corporate root CA installed on managed devices — common in banks, defence contractors, and healthcare — that appliance can read the content of the tunnel and block on the rendered content, not just the hostname. That is a different threat model, and the honest answer there is that no in-browser tool defeats a terminated tunnel.
The practical map:
| Deployment type | DNS block | SNI DPI block | TLS-terminating proxy |
|---|---|---|---|
| Change DNS to 1.1.1.1 | Works | Fails | Fails |
| Full VPN app (where allowed) | Works | Depends on obfuscation | Fails |
| Browser-tab web proxy | Works | Works | Fails |
| Personal LTE hotspot | Works | Works | Works |
The last row is the only universal answer, and it’s the one most people already know about. Everything else is a matter of matching the tool to the layer in front of you.
The trend line
The Stateline piece framed the current move as “anxiety over AI’s effect on learning intensifies.” That framing captures one motive. From the network-operator side, the more durable motive is simpler: any category with a fresh compliance question — data leakage, IP exfiltration, unverified output in regulated workflows — ends up on the filter list first and gets a nuanced policy later.
Institutional AI restrictions are going to keep expanding through the rest of 2026 and into 2027, for the same reason cloud storage restrictions expanded through 2015 and social media restrictions expanded through 2012. The pattern is not about the specific technology. It is about the gap between how fast a network can add a category to a blocklist and how fast a policy team can write a real rule.
Adults on managed networks who need occasional access to a categorised tool have the same options they’ve had for a decade: the honest workarounds, matched to the layer in front of them. What has changed is which category the block is aimed at.
Sources
- The largest US school districts restrict student AI use — Stateline, September 8, 2026.
- Prior enterprise-side coverage: Samsung ban (Bloomberg, May 2023), Apple restrictions (WSJ, May 2023), and ongoing federal agency guidance from GSA and CISA.