What is sensitive information disclosure?

Sensitive information disclosure is when an AI system reveals data that should have stayed protected: personal data, financial records, health details, credentials, internal policies or another customer's information. For AI agents, the risk grows with every system the agent can read and every channel it can write to.

Why does it matter once agents act?

A chat model can disclose only what is in its training data or its conversation. An agent connected to a CRM, a ticketing system and a document store can retrieve almost anything those systems hold, and it can send what it finds by email, in a chat reply or into another system. The disclosure is no longer a strange sentence on a screen; it is a record that has left the building.

It is listed in the OWASP Top 10 for LLM Applications, and the agent-specific angle is covered in OWASP sensitive information disclosure by AI agents. Under GDPR and similar laws, an agent that sends one customer's data to another is a personal data breach like any other.

How does it happen in practice?

The common routes are mundane:

• Over-broad retrieval. The agent searches a whole database when it needed one customer's record, and quotes the wrong one.
• Context bleed. Data from one conversation or task leaks into the next, especially when agents keep memory.
• Manipulation. A user or a planted instruction asks the agent to "include the full account history" or "paste the policy document".
• Agent to agent. One agent passes a full record to another that only needed a single field. How agents share information without leaking it covers this pattern.
• Logging. Sensitive values copied into logs or prompts that a wider group can read.

What does an example look like?

A people team connects an agent to its HR information system to answer staff questions about leave and benefits. An employee asks, "How much annual leave does my team have left?" Without scoping, the agent might list colleagues' leave balances, and from there their sickness absence. Scoped properly, its identity can read only the asking employee's own record, plus the team totals the employee's manager role allows. The question gets a useful answer and nobody's sickness record leaves the system.

How is it different from a data breach?

A data breach is the outcome: protected data reaching someone who should not have it, by any route. Sensitive information disclosure is one route, specific to AI systems, where the system itself hands the data over in its output. The distinction matters for prevention. Breach controls focus on perimeter and access; disclosure controls must also limit what the agent retrieves, what it carries between tasks and what it may put in an outgoing message.

How do you limit it?

Scope the agent's identity to the records its task needs, not the whole system. Retrieve by exact key where possible rather than by open search. Keep memory per customer and per task. Check outgoing messages for data that does not belong to the recipient before they leave. Hold any message containing special-category data for a person. Each of these is part of wider agent governance.

Where Pryme fits

Pryme applies role scope and sources to every action, so an agent's reach is limited to the records its capability needs. Outgoing actions are checked at the moment of action like any other, and the verdict and its reason are filed, which gives you the evidence if a disclosure is ever alleged.