Sensitive Data Disclosure via AI Agent

An AI agent exposes sensitive enterprise information by retrieving, combining, or transmitting data accessible through connected tools, APIs, memory, RAG systems, SaaS applications, or internal repositories beyond the authorization or intent of the requesting user.

Sensitive Data Disclosure via AI Agent occurs when an AI agent’s access to enterprise systems allows it to expose information that a user should not otherwise be able to obtain.

Unlike traditional LLM information leakage, an agent may possess authenticated access to external systems and tools. These can include email, document repositories, CRM platforms, ticketing systems, databases, cloud storage, internal APIs, source-code repositories, and knowledge bases.

The risk increases when the agent can autonomously retrieve information from multiple sources and combine those results into a response or downstream action.

A user may therefore never directly access the protected system. Instead, the agent becomes the intermediary that crosses the authorization boundary.

This makes agent authorization an important offensive-testing target: security teams must validate not only what the user can access, but what the AI acting on that user’s behalf can retrieve, infer, combine, and disclose.

An attacker or unauthorized user interacts with an enterprise AI agent that has access to connected data sources.

The attacker attempts to influence the agent into retrieving information outside the user’s intended authorization scope.

This may occur through direct instructions, indirect prompt injection, manipulated documents, tool invocation, context manipulation, or exploitation of weak authorization controls.

The agent queries one or more connected systems using its own identity, delegated credentials, service account, OAuth token, or another authorization mechanism.

Because the downstream system trusts the agent’s credentials, it may return information that the requesting user could not access directly.

The AI system subsequently incorporates that information into its context and exposes it through a response, generated artifact, tool action, external communication, or another connected system.

User Request → Agent Reasoning → Tool Selection → Privileged Retrieval → Context Aggregation → Unauthorized Disclosure

1. Agent Access
The attacker obtains legitimate or compromised access to an enterprise AI agent.

2. Context Manipulation
Instructions are crafted to encourage retrieval of information beyond the user’s legitimate business need or authorization.

3. Tool Invocation
The agent selects an integrated enterprise tool or data source.

4. Credential Delegation
The tool request executes using agent credentials, delegated authorization, or a privileged service identity.

5. Sensitive Retrieval
Protected information is returned to the agent.

6. Context Aggregation
The model combines retrieved information with conversation history, memory, RAG context, or information obtained from other systems.

7. Authorization Failure
The system fails to enforce the requesting user’s authorization boundary on the retrieved information.

8. Disclosure
Sensitive data appears in model output or is transferred through another agent action.

• Enterprise AI assistants
• Autonomous AI agents
• MCP-enabled applications
• RAG systems
• Microsoft 365 / Google Workspace integrations
• CRM systems
• Ticketing platforms
• Internal knowledge bases
• Cloud storage
• Databases
• Source-code repositories
• Email systems
• HR platforms
• Financial systems
• Internal APIs
• SaaS applications
• Agent memory stores

Enterprise AI agents increasingly operate with access to data that previously required users to interact with multiple applications independently.

That creates a new authorization problem.

An employee might be correctly prevented from opening a restricted document directly while an AI agent, operating with broader permissions, can retrieve the same document and summarize its contents.

The resulting exposure may include intellectual property, customer information, employee records, source code, credentials, financial information, legal documents, security findings, or regulated data.

The business risk extends beyond confidentiality. Unauthorized information retrieved by an agent may subsequently be written into another system, included in generated content, transmitted externally, stored in memory, or exposed to additional users.

Enterprise AI security testing should therefore validate the entire authorization chain:

User → Agent → Tool → Data → Model → Output

A failure anywhere in that chain can turn a trusted enterprise AI assistant into an unintended privileged data-access layer.

Authorized testing should evaluate whether an AI agent can retrieve or disclose information beyond the effective authorization of the requesting identity.

Test cases should include:

• Requests for data belonging to another user
• Cross-department information retrieval
• Restricted document discovery
• Executive or privileged mailbox access
• Retrieval through connected SaaS applications
• Cross-tenant data isolation
• Agent memory leakage
• RAG authorization enforcement
• Manipulated tool parameters
• Indirect prompt injection designed to trigger retrieval
• Multi-step requests that gradually expand data access
• Cross-tool information aggregation
• Attempts to summarize otherwise inaccessible documents
• Requests based on metadata rather than known filenames
• Sensitive information passed into downstream agent actions

A particularly important test is whether the agent respects the user’s permissions rather than merely the agent’s permissions.

Testing should use synthetic or explicitly authorized data whenever possible.

Monitor for:

• AI agents retrieving unusually large datasets
• Access to repositories unrelated to user role
• Cross-department information requests
• High-volume tool invocation
• Sensitive-document retrieval followed by model output
• Agent access to privileged mailboxes
• Unexpected cross-system correlation
• Repeated denied queries followed by alternative retrieval strategies
• Sensitive information appearing in agent logs or memory
• Unusual service-account activity
• Tool calls inconsistent with the user’s permissions
• Agent access occurring without corresponding user authorization
• Retrieval immediately followed by external communication

Relevant ATT&CK behaviors may include: T1213 — Data from Information Repositories T1530 — Data from Cloud Storage T1114 — Email Collection T1005 — Data from Local System T1078 — Valid Accounts T1552 — Unsecured Credentials Exact mappings depend on the system and data source involved.

OWASP Mapping Strongly related to: OWASP LLM02 — Sensitive Information Disclosure Agentic authorization and identity/privilege risks Tool misuse where agent capabilities permit unauthorized retrieval