Almost 10% of GenAI Prompts Include Sensitive Data: Study

Harmonic Security analyzed tens of thousands of enterprise prompts to ChatGPT, Copilot, Gemini, Claude and Perplexity and found 8.5% contained sensitive information—primarily customer (45%+) and employee (~27%) data, plus legal/financial, security, and code-related content. The report highlights that a large share of these sensitive prompts were submitted via free-tier AI services (which often lack enterprise protections and may train on submitted data), and recommends real-time monitoring of data sent to GenAI, enforcing paid enterprise plans, departmental usage workflows, and ongoing user education to reduce leakage risk.