LLM02: Sensitive Information Disclosure · 2026

Disclosure can occur in responses, tool arguments, logs, embeddings, caches or side channels throughout the system lifecycle.

Summary

Disclosure can occur in responses, tool arguments, logs, embeddings, caches or side channels throughout the system lifecycle.

How the attack works

The model includes private data in tool arguments; a shared trace records it without redaction and exposes the information.

Example

Vulnerable · Pseudocode

result = llm(private_context)
trace.write(result.tool_arguments)
# Personal data enters shared logs

Fix: Authorize sources before retrieval, minimize context and redact sensitive data in outputs and traces.

Prevention

Classify, minimize and clean data before ingestion.
Authorize documents within the retrieval query.
Redact responses and logs and protect embeddings and caches.

Lineage

2025 · LLM02: Sensitive Information Disclosure Remains at rank 2
2026 · LLM02: Sensitive Information Disclosure Continues at rank 2

2025:LLM02 → 2026:LLM02: Sensitive Information Disclosure retains rank 2.

Sources

Open official source ↗

Buy me a coffee