Data Leakage: AI’s Plumbing Problem

This report outlines how AI/LLM systems can leak sensitive data through application-level issues (RAG bypassing access controls, agentic tool chaining and data commingling), training data memorization and prompt injection, and user-introduced oversharing, with leaks propagating via responses, downstream integrations, queries, logs, and shared context. It recommends a defense-in-depth approach: carefully scoping model training, and implementing automated data classification, minimization at ingress, sanitization, redaction, and granular access control across the AI pipeline.