LLM sensitive information disclosure

When it applies

The LLM app touches data beyond the user's own input: a RAG corpus of internal documents, fine-tuning on private data, per-tenant knowledge bases, tool access to databases/files, or logged conversation history. The core question: can the model be coaxed into emitting data that belongs to someone else — another tenant, the operator, or the training set?

Why it works

The model has no access control — everything in its context window is equally "its" knowledge, so any data the pipeline injects (retrieved chunks, system prompt, tool results) is one clever question away from the user. Memorization adds a second channel: models regurgitate training data verbatim under the right probes. Authorization failures compound it — if the retrieval or tool layer doesn't filter by tenant, the model happily answers across tenant boundaries.