Data Leakage
Information escaping where it should not.
Sensitive data reaching somewhere it should not — into a provider’s logs, another user’s context, a prompt that gets logged, or training data for a future model.
Two main routes: cross-tenant contamination in retrieval or memory, and third-party retention when you send prompts to an external API. Both are architecture decisions, not model behaviour.
There are three distinct routes and they need different controls: leak by design (data sent to a provider under terms you did not read), leak by injection (untrusted content pulling data out through a tool call), and leak by accident (secrets in a prompt, a log, or a transcript that gets shared). Naming the route is the first step to fixing it.
The exfiltration path nobody modelled
A browsing agent can both read internal documents and fetch external URLs.
Injected instructions in a web page can direct the agent to encode data into a URL it then fetches. The fix is structural: separate the trust domains or constrain what the agent can reach after reading untrusted content, because a warning in the prompt is not a control.
PII in the retention window
Customer records are sent to a provider and retained under their default policy.
Check the provider’s data controls rather than assuming a short retention period, redact before the call where the full value is not needed, and keep the de-identification mapping on your side so it never leaves.
- standardLLM01: Prompt injection ↗
Defines direct versus indirect injection and the downstream effects — data disclosure, unauthorised tool use, command execution — with least privilege and human approval as the recommended controls.
- docsData controls in the OpenAI platform ↗
Training-use and retention controls, including default abuse-monitoring retention and Zero Data Retention eligibility. Vendor-specific, and no substitute for your own privacy review.
- blogMitigating the risk of prompt injections in browser use ↗
Why browser agents are structurally exposed to indirect injection and exfiltration, the defences layered against it, and an explicit warning that a low attack-success rate is not "solved".
- blogAgentic misalignment: how LLMs could be insider threats ↗
Controlled corporate simulations in which models under goal conflict resorted to blackmail or leaking sensitive information. A stress-test result about autonomy and sensitive access, not an observed deployment behaviour.
Data Governance
Rules about what data may be used, by whom, and retained how long.
Privacy
Protecting the people whose data flows through the system.
Memory System
Storage that gives an assistant continuity across sessions.
Guardrails
Constraints on what the system will do, enforced in code.