Sensitive Information Disclosure in LLMs
Language models can leak what they should never say — personal data, credentials, proprietary code, another user’s session. Sensitive information disclosure (OWASP LLM02:2026) is when private data reaches the output, whether it was memorised in training, sitting in the context window, or pulled in by a tool the model was too trusted to question.
Study your own systems. Probing a model you own or are authorised to test for leakage is security work; extracting other people’s data from a live service is not. Keep it to systems you have permission to assess.
What it is
An LLM has no innate sense of what is confidential. If sensitive data was in its training set, its fine-tuning, its system prompt, or the documents it retrieves, it can surface that data in an answer — sometimes verbatim, sometimes reconstructed. The failure is rarely the model “deciding” to leak; it is that the sensitive data was reachable at all.
The threats
Where it shows up in practice.
| Threat | How it works |
|---|---|
| Training-data memorisation | Secrets or PII in the training corpus get memorised and can be coaxed back out with the right prompt. |
| Context / session bleed | Data from one user or request lingers and surfaces in another — shared caches, poorly scoped sessions, or a stuffed context window. |
| Over-trusted tool output | The model is given a tool or database that returns more than the user is entitled to, and it faithfully relays it. |
| Hidden-context exposure | Credentials or config placed in the prompt / context leak out — overlaps with LLM08 Hidden Context Exposure. |
| RAG over-retrieval | A retrieval step pulls documents the current user should not see and the model quotes them — see vector & embedding weaknesses. |
How to defend
- Minimise sensitive data going in. Scrub PII and secrets from training and fine-tuning sets; do not train on data you would not want echoed back.
- Never put secrets in prompts. API keys, credentials and config belong in a vault the app reads, not in the system prompt or context.
- Enforce authorisation at the data layer. The model should only ever retrieve what the current user is allowed to see — filter per-user before retrieval, not after.
- Filter the output. Run responses through PII / secret detection before they leave, and redact.
- Isolate users and sessions. Scope context windows and caches so one request can never see another’s data.
- Test for leakage. Red-team your own model with extraction prompts before shipping.
Go deeper
- The full 2026 risk map: OWASP LLM Top 10.
- Retrieval leaks: Vector & embedding weaknesses (LLM09).
- Prompt/context as a leak source: Hidden context exposure (LLM08).
- Where leakage sits in an attack: the “actions on objectives” stage of the Cyber Kill Chain.
Aligned to OWASP LLM02:2026 Sensitive Information Disclosure — the OWASP GenAI LLM Top 10 2026 edition (released Aug 2026). A plain-language distillation of current practice. Something changed? Tell me.