aisecurityrisks.com

# R-02·OWASP LLM02:2026·cases 3·checked Nov. 15, 2026

Sensitive information disclosure

Confidential, regulated or secret data comes out of an AI system to someone who shouldn't have it.

What it is

OWASP counts every output channel, not only the answer on screen: tool-call arguments, retrieved chunks, logs, telemetry, embeddings and reasoning traces can all leak. Data can come out of what a model memorized in training, out of the live context it was given, or through what it was allowed to retrieve.

For most organizations the practical question is what the AI can see. An assistant that can search everything a user can open will also surface files that were shared more widely than intended.

Documented cases

Incidents happened in the wild. Research demos were shown by researchers, often disclosed to the vendor first.

  • Research demodisclosed June 11, 2025·AML.CS0059

    EchoLeak: one email, data out of Microsoft 365 Copilot

    Researchers showed that a single crafted email could make Microsoft 365 Copilot send internal data to an attacker with no click from the victim. Copilot pulled the email into its context, and the chain got past an injection classifier and link redaction, then used auto-fetched images and a Teams proxy allowed by the content security policy.

    Tracked as CVE-2025-32711, described as AI command injection in M365 Copilot that lets an unauthorized attacker disclose information over a network.

    Sources: Reddy and Gujral, arXiv:2509.10540; NIST National Vulnerability Database; MITRE ATLAS AML.CS0059

  • Research demodisclosed April 1, 2025·AML.CS0054

    Hidden instructions in an MCP tool description

    Invariant Labs put instructions in the description of an innocent-looking add tool. In Cursor, the agent then read the user's MCP config file and SSH private key and sent them out through a hidden tool parameter. The confirmation dialog did not show the full input.

    The researchers also described rug pulls (a server changes a tool after approval) and shadowing (one server's tool description changes how the agent uses another server's tool). They recommend pinning server versions and showing users full tool descriptions.

    Sources: Invariant Labs; MITRE ATLAS AML.CS0054

  • Research demodisclosed Aug. 20, 2024·AML.CS0035

    Slack AI leaked a private-channel API key

    PromptArmor posted an instruction in a public channel that only the attacker had joined. When a victim later asked Slack AI about their own private messages, it followed the instruction and showed a "reauthenticate" link carrying an API key from a private channel. The citation pointed only to the victim's channel.

    Slack told the researchers this was intended behavior, since public channel messages are searchable by all workspace members.

    Sources: PromptArmor; MITRE ATLAS AML.CS0035

Controls to start with

Questions to ask vendors

Our suggestions, not taken from a framework.

  • Is our data used to train or improve your models, and where is that stated in the contract?
  • Which of our data can the assistant retrieve, and does it respect the same permissions as the source system?
  • How long do you keep prompts, outputs and logs, and who at your company can read them?

Sources

  1. OWASP Top 10 for LLM Applications 2026. OWASP GenAI Security Project, Aug. 3, 2026.Standard or framework · read: full text (122-page PDF) · retrieved Nov. 15, 2026 · license CC BY-SA 4.0note: Community list. OWASP says the 2026 ranking combines a practitioner vote with incident evidence. Appendix A maps each entry to other frameworks.
  2. OWASP Top 10 for Agentic Applications 2026. OWASP GenAI Security Project, Dec. 9, 2025.Standard or framework · read: full text (PDF) · retrieved Nov. 15, 2026 · license CC BY-SA 4.0note: Covers risks once a model acts as an agent with tools, memory and delegated authority.
  3. MITRE ATLAS data, release 2026.10. MITRE, Oct. 28, 2026.Standard or framework · read: full data file (tactics, techniques, case studies) · retrieved Nov. 15, 2026 · license Apache-2.0note: ATLAS labels each case study as an Incident (real-world) or an Exercise (research or red-team demonstration).
  4. NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. National Institute of Standards and Technology, July 2024.Government guidance · read: sections 2.4 (Data Privacy), 2.7 (Human-AI Configuration) and 2.9 (Information Security) read in full · retrieved Nov. 15, 2026 · license US government worknote: Voluntary profile. Names 12 risks that generative AI creates or makes worse.
  5. EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System. Reddy and Gujral, arXiv:2509.10540, Sept. 6, 2025.Academic preprint · read: abstract only · retrieved Nov. 15, 2026note: Preprint by the researchers who found the flaw (Aim Security). Not peer reviewed.
  6. CVE-2025-32711. NIST National Vulnerability Database, June 11, 2025.Vulnerability record · read: description via NVD API · retrieved Nov. 15, 2026
  7. MCP Security Notification: Tool Poisoning Attacks. Invariant Labs, April 1, 2025.Security vendor research · read: full page · retrieved Nov. 15, 2026note: Invariant Labs builds agent security tooling.
  8. Data Exfiltration from Slack AI via indirect prompt injection. PromptArmor, Aug. 20, 2024.Security vendor research · read: full page · retrieved Nov. 15, 2026note: PromptArmor sells AI security products. Slack told the researchers the behavior was intended.