Issue Details
Sensitive Information Disclosure
llm06-2024 • Rank #6 in OWASP 2025
Explanation
Sensitive information disclosure in LLM systems can occur through prompt leakage, retrieval exposure, weak output filtering, or insecure context handling. Attackers coax models into revealing secrets, internal policies, or regulated records. Leakage risk rises when broad context windows and mixed-trust data are used without strict isolation.
Remedy
Minimize sensitive context in prompts and retrieval payloads, and apply layered redaction and output filtering. Segment data access by least privilege and enforce policy checks before retrieval and response emission. Log disclosure attempts and test for extraction vectors using adversarial prompt scenarios.
| Year | Rank | Category |
|---|---|---|
| 2024 | #6 | llm06-2024 - Sensitive Information Disclosure |