OWASP Top 10 for LLMs
LLM02
Sensitive Information Disclosure
Models leak secrets, PII, or proprietary data through outputs, context windows, or training data.
LLM applications can expose sensitive information that was placed in the prompt, retrieved into context, or memorized during training. Disclosure can be direct (the model repeats a secret) or indirect (membership inference, model inversion, or data beaconing through rendered output).
How it shows up
- A model repeats API keys that were placed in its system prompt.
- Conversation data is exfiltrated via a markdown image URL that the client auto-renders.
- Membership-inference queries reveal whether a record was in the fine-tuning set.
Mitigations
- Keep credentials and secrets out of the model context entirely; use a secrets manager.
- Sanitize and sandbox output — strip or neutralize links and images from untrusted responses.
- Apply data minimization and scrubbing to training and retrieval data.
- Add output filters for PII and known secret formats.