An agent can disclose anything that reaches its context: personal data, credentials, business records. Reduce what gets in, limit which data sources it can read, redact before processing, and do not count on a system prompt instruction to keep secrets, because injection can bypass it.
What counts as sensitive
OWASP LLM02:2025 lists personal identifiable information, financial details, health records, confidential business data, security credentials and legal documents. Proprietary training methods and source code can be sensitive too. The risk covers both the model and the application context around it.
OWASP's example scenarios
- A user receives another user's personal data because sanitization was inadequate.
- An attacker bypasses input filters through targeted prompt injection to extract sensitive information.
- Sensitive data included carelessly in training leads to disclosure.
For agents, the first scenario shows up as shared memory or retrieval that is not scoped per user.
Controls from the guidance
- Sanitization: scrub or mask sensitive content before it enters training or prompts, and validate inputs.
- Access controls: least privilege, and limit the model's access to external data sources.
- Privacy techniques: federated learning and differential privacy, where they fit.
- Transparency: tell users not to enter sensitive data, publish retention and usage policies, and offer opt outs.
- Secure configuration: limit users' ability to override system settings, and avoid leaking details through error messages.
- Tokenization or pattern based redaction before processing.
The warning to remember
The OWASP page cautions that system prompt restrictions on what the model may return may not always be honored and can be bypassed through prompt injection. So a line saying never reveal the API key is not a control. If the key is in context, assume it can come out.
Agent specific habits
- Keep credentials out of the prompt. Let tools hold them and give the model a handle.
- Scope retrieval and memory per user, so one user's records cannot be fetched for another.
- Redact tool results that include fields the task does not need before they go back into context.
- Remember logs. Prompts and tool results written to logs can become a second copy of the sensitive data.
- Review error messages that tools return, since they are put straight into context.
A quick exercise
Ask the agent, in a test environment, to print everything it can see about the current user and the current system. Whatever appears is the exposure you actually have.
Where Safeguard fits
Safeguard includes agent identity, policies and compliance evidence automation, which can help show who accessed what. A free scan at https://gold.safeguard.sh/scan can also check your dependencies.
Quick check
Is it safe to put an API key in the system prompt if I tell the model to keep it secret?
No. OWASP notes such restrictions may not be honored and can be bypassed. Keep secrets out of the context and let the tool layer hold them.
Sources
Last reviewed: 19 October 2026.
