GenAI increases risk because it processes large volumes of sensitive data while expanding the number of interfaces, sessions, and browser interactions attackers can target. When that surface grows, phishing, malicious scripts, cookie theft, and extension abuse become easier entry points. The result is a higher chance of unauthorized access, data tampering, and privacy loss across the user journey.
Why GenAI expands the exposure surface in customer-facing apps
Customer-facing GenAI usually sits in the middle of a lot more data flow than a conventional app. It can ingest prompts, chat history, profile data, uploaded files, support notes, and retrieval results, then reflect that material back into browsers, APIs, logs, and downstream systems. That creates more places where sensitive content can be captured, copied, inferred, or exposed.
The risk is not only the model itself, but the surrounding application stack. The secret sprawl challenge shows how often sensitive material ends up in places it should not, while real-world incidents such as the McKinsey AI platform breach illustrate how chat systems can expose large volumes of user and business data when controls are weak. In practice, every extra integration, session, and frontend interaction increases the chance that data will cross a trust boundary unsafely.
That is why GenAI changes the problem from a narrow application feature into a broader data-handling concern. If the app can retrieve records, summarize content, or take user-specific context, it also has more chances to surface data to the wrong user, retain it longer than intended, or store it in logs and caches that were never designed for sensitive conversational content.
How attackers turn GenAI interactions into manipulation paths
GenAI also increases manipulation risk because it treats untrusted user input as a first-class part of the workflow. Attackers can use phishing, malicious scripts, prompt injection, cookie theft, browser extension abuse, and compromised sessions to influence what the application shows, returns, or sends onward. In a customer-facing setting, that can corrupt recommendations, distort support responses, or change the data a user believes is authoritative.
When a model is allowed to read external content, summarize customer records, or act on behalf of a user, the attacker’s goal is often not to break the model directly. The goal is to bias the surrounding workflow, redirect outputs, or cause the application to combine trusted and untrusted inputs in a way that produces false, incomplete, or unsafe results. That is why manipulation risk is tied to both content trust and session integrity.
The browser layer matters here because it is where many customer interactions begin and where identity, session state, and rendered content meet. If malicious code can access a live session or alter what the user sees, the GenAI system may faithfully process poisoned context and present a convincing but wrong outcome. This is especially dangerous when the application presents summaries, decisions, or action recommendations that users assume are reliable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 address the attack and risk surface, while NIST AI 600-1, NIST AI RMF, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI 600-1 | MAP — Generative AI Profile | GenAI customer apps need controls for data handling, provenance, and misuse. |
| Recommendation — Apply the GenAI profile to govern inputs, outputs, and exposure paths across the app. | ||
| NIST AI RMF | GOVERN — Govern | This is a governance problem for customer data, trust, and model use. |
| Recommendation — Establish AI governance for approved data use, retention, and human oversight. | ||
| CIS Controls v8 | 8.2 — Data Protection | Customer-facing GenAI can expose sensitive data through logs, caches, and outputs. |
| 6.3 — Access Control Management | Manipulation risk rises when sessions or user contexts are not tightly controlled. | |
| Recommendation — Protect sensitive data in transit, at rest, and in application outputs. Restrict access paths and remove unnecessary privileges from GenAI components. | ||
| OWASP Agentic AI Top 10 | A1 — Prompt Injection | Untrusted inputs can steer customer-facing GenAI toward unsafe or altered outputs. |
| A3 — Tool Misuse | GenAI apps that call tools or backends can be manipulated into harmful actions. | |
| Recommendation — Harden input boundaries to prevent attacker-controlled content from steering responses. Constrain tool use so model-driven actions stay within explicit policy and scope. | ||
| NIST CSF 2.0 | PR.DS — Data Security | The question centers on protecting customer data from exposure and tampering. |
| PR.AC — Identity Management, Authentication, and Access Control | Session abuse and unauthorized access are central paths to GenAI exposure. | |
| Recommendation — Apply data security controls to limit disclosure, alteration, and unauthorized retention. Enforce strong authentication and access control around customer-facing GenAI sessions. | ||
Practitioner Guidance
What to prioritise: Treat GenAI features that handle customer data as high-exposure workflows, not as ordinary UI enhancements. The first question is whether the model can see data it does not strictly need, and whether the browser session or downstream integration can be abused to change what the model receives or returns.
What to verify: Confirm that sensitive content is not being echoed into logs, analytics, client-side storage, or cached responses without a clear retention need. Also verify that the app distinguishes between trusted system instructions, retrieved data, and user-supplied content, because confusion between those layers is a common path to both leakage and manipulation.
Common mistake: Teams often focus on model safety while leaving session hardening, extension risk, input validation, and output filtering underdeveloped. In customer-facing applications, those surrounding controls usually decide whether the GenAI feature is merely noisy or genuinely dangerous.
Practitioner takeaway: The security question is not whether GenAI can answer correctly in isolation, but whether the full customer journey can keep sensitive data bounded, unpoisoned, and attributable from browser to backend.
Related resources from NHI Mgmt Group
- Why do customer support workflows increase data exposure risk?
- Why does weak LLM observability increase risk in customer-facing applications?
- Why does weak CIAM increase fraud and account takeover risk in customer-facing applications?
- Why do excessive permissions and inactive accounts increase the risk of data exposure in customer support systems?
