JCC logo
OWASP Risks Atlasby Jer Catallo

Issue Details

Sensitive Information Disclosure

llm06-2024 • Rank #6 in OWASP 2025

Explanation

Sensitive information disclosure in LLM systems can occur through prompt leakage, retrieval exposure, weak output filtering, or insecure context handling. Attackers coax models into revealing secrets, internal policies, or regulated records. Leakage risk rises when broad context windows and mixed-trust data are used without strict isolation.

Remedy

Minimize sensitive context in prompts and retrieval payloads, and apply layered redaction and output filtering. Segment data access by least privilege and enforce policy checks before retrieval and response emission. Log disclosure attempts and test for extraction vectors using adversarial prompt scenarios.

YearRankCategory
2024#6llm06-2024 - Sensitive Information Disclosure