Risks

Sensitive information disclosure through agent actions

Sensitive information disclosure is when an AI system exposes personal data, credentials, business records or its own instructions to someone who should not see them. OWASP covers it as LLM02:2026, with leaked instructions under LLM08:2026 Hidden Context Exposure. In agents, tool calls and links become the exit. We test each exit.

• OWASP LLM02:2026
• OWASP LLM08:2026
• AML.T0057
• AML.T0056

LLM02 unchanged from 2025. LLM08:2026 Hidden Context Exposure was formerly LLM07:2025 System Prompt Leakage

What counts as sensitive information disclosure?

OWASP's LLM02:2025 entry covers personal information, financial and health data, confidential business data, credentials and proprietary model details reaching people who should not see them. LLM07:2025 System Prompt Leakage is the narrower case where the instructions themselves leak, and OWASP's point there is that the real risk is what those instructions contain, such as keys, role structures or permission rules.

MITRE ATLAS splits the attacker's moves into LLM Data Leakage (AML.T0057), Extract LLM System Prompt (AML.T0056) and, specific to agents, Exfiltration via AI Agent Tool Invocation (AML.T0086), where a write-capable tool carries the data out inside its arguments.

How do agents leak data?

A chat model leaks in its reply. An agent has more exits, and most of them do not look like a leak in your logs:

• Rendered links and images. A markdown image URL with record fields in the query string is fetched by the client and lands on an outside server.
• Outbound tools. Email, chat, ticket comments and webhooks that accept free text.
• Cross-tenant reads. A lookup tool keyed only on an ID returns another customer's record.
• Tool arguments. Search or analytics calls whose parameters carry secrets to a third party.
• Instructions. The system prompt, tool descriptions and configuration, which MITRE tracks as AML.T0084 Discover AI Agent Configuration.

Illustrative trace

Illustrative example, not a real customer finding.

What do we test?

Disclosure is the data exfiltration class in an Agent Action Pentest, and it usually rides on the other three. We try direct requests, indirect payloads in content the agent reads, and role confusion to reach records outside the caller's scope. For every exit we find, the report gives the input, the tool call or rendered output, and the data that left. We also check whether the system prompt holds anything that would matter if it leaked, because OWASP's advice is to assume it can.

How do you prevent it?

From LLM02:2025: enforce strict access controls based on least privilege, restrict data sources and manage runtime data orchestration securely, apply input validation, and conceal the system preamble. From LLM07:2025: keep API keys, auth keys, database names, user roles and permission structures out of system prompts, avoid relying on the prompt for strict behavior control, implement guardrails outside the model, and enforce security controls such as privilege separation and authorization checks independently of the LLM.

For agents, add two of our own observations from the test side: strip or proxy external image and link rendering, and key every lookup tool on the authenticated user, not only on an ID the model supplies.

Which frameworks and integrations are affected?

Any agent with read tools and an outbound channel. LangChain agents and OpenAI Agents SDK apps both let a tool return data that the model then reuses in another call. Payment data deserves care: see agents with Stripe access.

Last reviewed: 2026-10-14