OWASP LLM02 sensitive information disclosure: what does it look like?

OWASP LLM02 (Sensitive Information Disclosure) is when an LLM or the application around it exposes personal data, credentials, confidential business data or proprietary details through its output. The fixes are sanitizing data before it reaches the model, strict access controls, and limiting what the model can see.

What does the risk cover?

OWASP's page says sensitive information can affect both the model and its application context: personal data, financial details, health records, confidential business data, security credentials and legal documents. When an LLM is embedded in an application, it can expose this data, proprietary algorithms or confidential details through output, leading to unauthorized access, privacy violations and intellectual property breaches.

The three common examples it lists are personal data leakage, proprietary algorithm exposure and disclosure of sensitive business data.

What are OWASP's scenarios?

Three scenarios appear on the page.

Unintentional exposure. A user receives a response containing another user's personal data because data was not sanitized well enough. This is the plain, everyday version: a shared index or shared conversation memory that mixes tenants.

Targeted prompt injection. An attacker bypasses input filters to extract sensitive information. We do not reproduce techniques here. The point is that filters alone are not a boundary.

Leak through training data. Careless inclusion of sensitive data in training leads to it appearing later in outputs.

Is there a real world reference?

OWASP cites the Proof Pudding attack, tracked as CVE-2019-20634, in which disclosed training data enabled model extraction and inversion. It also links to reporting on a ChatGPT leak at Samsung and on ChatGPT outputting sensitive data when told to repeat a word forever. We have not independently verified those linked reports, so read them directly through the OWASP page before quoting them.

The Samsung item is useful as a pattern even without details: employees pasting internal material into an external tool is a data handling problem as much as a model problem.

What controls does OWASP recommend?

Grouped as the page does:

• Sanitization. Data sanitization techniques and input validation, so sensitive content is scrubbed before it enters training or prompts.
• Access controls. Strict access control and restricting data sources, on the least privilege principle.
• Privacy techniques. Federated learning and differential privacy to reduce what can be recovered.
• User education and transparency. Train users on safe use and be clear about how data is used.
• Secure configuration. Conceal the system preamble and follow general security misconfiguration guidance.
• Advanced techniques. Homomorphic encryption, tokenization and redaction.

How do you turn that into engineering work?

Start with a data flow diagram for each LLM feature. Mark every place where text enters the model: user input, retrieved documents, tool output, logs fed back. Then mark what the model can return and who sees it.

Next, enforce access at retrieval time, using the caller's permissions, not the application's. A model cannot leak what it was never given. Redact secrets and personal data before they enter prompts and logs. Keep credentials out of anything a model reads; they belong in a secrets manager with scoped tokens.

Finally, test it. Create synthetic canary records, and check that they never appear for the wrong user.

What to do

1. Draw the data flow for each LLM feature and mark every input.
2. Apply the calling user's permissions at retrieval, per request.
3. Redact secrets and personal data before prompts, logs and training sets.
4. Remove credentials from anything a model can read.
5. Add synthetic canary records and assert they stay isolated per tenant.
6. Publish a short staff rule on what may be pasted into external AI tools.

Quick check

Sources

• OWASP GenAI, LLM02:2025 Sensitive Information Disclosure, fetched 18 October 2026.

Last reviewed: 18 October 2026.