TL;DR: Lasso found that 13% of employee-submitted GenAI prompts contained sensitive organizational data, with 30% of code-sharing prompts exposing credentials or proprietary code and 38% of network-exposure prompts revealing internal infrastructure details, according to Lasso Security. The risk is not the chatbot itself but the governance gap between everyday employee use and enforceable data-sharing controls.
At a glance
What this is: Lasso Security’s study shows that employee use of GenAI chatbots is already exposing sensitive organisational data, credentials, and internal network details at a measurable rate.
Why it matters: IAM, security, and governance teams need controls that address what users can disclose to AI tools, because the risk is prompt-driven data leakage rather than the model alone.
By the numbers:
- 13% of employee-submitted prompts to GenAI chatbots contained sensitive organizational data.
- 30% of prompts in the code and token sharing category included exposed credentials, secrets, or proprietary code.
- 38% of network information submissions posed direct risk by enabling network reconnaissance.
Context
Generative AI prompt leakage is an identity governance problem as much as a data protection problem. When employees paste code, credentials, internal URLs, or personal data into chat interfaces, the organisation loses control over where that information is processed, stored, or reused.
This is not a model-quality issue. It is a boundary issue between user behaviour, policy enforcement, and the expanding set of GenAI tools now embedded in everyday work.
The article’s core finding is typical of early enterprise GenAI adoption: the controls around disclosure lag the speed of employee experimentation.
Key questions
A: Security teams should treat GenAI as an inference layer, not just a retrieval layer. Start by classifying sensitive content, then constrain which sources can be combined for a given user, prompt, and context. Add prompt simulation, provenance tracing, and semantic risk detection so oversharing is caught before it reaches production or end users.
Q: Why do AI agents create a different data leak risk than employee chat prompts?
A: AI agents can retrieve data directly from SaaS apps, internal tools, and databases on a user’s behalf, so the employee does not need to copy data into a prompt manually. That changes the control point from user behavior alone to agent access and data flow governance. Security teams need visibility into what agents can reach and what they can return.
Q: What signals show that AI access is outpacing governance?
A: The clearest signals are broad inherited permissions, large volumes of stale guest access, and inconsistent file classification across teams. If remediation is happening only after AI rollout, the programme is reacting to exposure rather than controlling it.
Q: How does prompt injection change the way teams should evaluate GenAI risk?
A: Prompt injection shows that a chatbot can be steered by attacker-supplied instructions hidden in the prompt or surrounding content. That means teams should evaluate not only what users type, but also what external content the system ingests and trusts. If the model can be manipulated into ignoring rules, the interface is not a safe boundary.
Technical breakdown
Prompt data leakage and external processing boundaries
GenAI chatbots often sit outside traditional data-loss assumptions because the prompt itself becomes the transfer mechanism. When employees submit code, secrets, network identifiers, or personal data, that content may be logged, retained, or echoed in downstream systems. The technical risk is not just the immediate prompt, but the broader processing boundary created when sensitive information leaves controlled enterprise systems and enters an LLM workflow. That boundary is hard to govern with perimeter controls alone, because the user action looks legitimate while the data handling path may not be.
Practical implication: govern what can be pasted into GenAI tools before the prompt leaves the user session.
Shadow LLM discovery and policy enforcement
Shadow LLM means employees are using approved and unapproved GenAI tools without central visibility. In practice, that breaks inventory, policy, and enforcement because security teams cannot protect what they do not know exists. The article points to continuous discovery across thousands of tools as a necessary control plane for prompt governance. Once discovery exists, policy can be applied to categories of content, not just to a single branded chatbot. That matters because disclosure risk follows the user, not the logo on the interface.
Practical implication: build a live inventory of GenAI use and enforce disclosure policy across the whole tool set.
Prompt injection and jailbreak exposure
The article also references jailbreak attempts and prompt injection, which are techniques for bypassing model restrictions by manipulating instructions in the prompt or surrounding content. These attacks matter because they can force a chatbot to ignore its intended safety rules, leak data, or generate harmful output. For IAM and security teams, this is a reminder that policy at the interface is not the same as trust in the model. The control challenge is to detect risky content before submission and to assume that the model may follow attacker-supplied instructions when boundaries are weak.
Practical implication: add pre-submission scanning and response monitoring where GenAI is used for business workflows.
Threat narrative
Attacker objective: The attacker aims to harvest useful enterprise data from routine GenAI interactions and turn employee prompts into a reconnaissance and access advantage.
- Entry occurs when an employee submits code, credentials, internal URLs, or personal data into a GenAI prompt from a normal business workflow.
- Credential and data exposure follows when the model or surrounding platform processes, stores, or logs the submitted information outside enterprise control.
- Escalation occurs when exposed network details or secrets enable reconnaissance, phishing support, or downstream misuse across internal systems and third-party services.
- Impact is the loss of confidentiality, increased breach exposure, and possible compliance or reputational damage from prompt-driven disclosure.
Breaches seen in the wild
- OmniGPT breach claim 2025: A hacker claims to have leaked 34 million OmniGPT AI chat messages holding users' API keys and credentials; OmniGPT has not confirmed it.
- Meta AI Instagram Account Takeover: 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Prompt governance is now a disclosure-control problem, not a chatbot problem. The article shows that employees are already using GenAI tools in ways that move sensitive business data outside governed enterprise systems. That makes disclosure policy, not model novelty, the real control boundary. The practitioner lesson is that prompt handling must be treated like any other data egress path.
Shadow LLM creates an identity blind spot. When employees use multiple GenAI tools without central discovery, security teams cannot apply consistent policy or trace data-sharing behaviour. That is an identity and governance failure because the user-to-tool relationship becomes untracked, unreviewable, and hard to constrain. The programme implication is that discovery has to precede enforcement.
Runtime prompt controls are the new least-privilege layer for GenAI. Traditional least-privilege thinking assumes access to data can be granted or denied at the system boundary. In GenAI, the risky act is often the prompt itself, so the control point shifts to content filtering, session enforcement, and pre-submission screening. Practitioners should treat prompt content as a governed entitlement.
Prompt injection exposes the weakness of trust-by-interface assumptions. A user-facing chatbot that accepts untrusted instructions or hidden prompts cannot be governed as a simple application form. The risk is compounded when business users assume the chat layer is safe because it feels conversational. Security teams need to recognise that conversational UX can hide adversarial control flows.
GenAI adoption is outpacing disclosure governance. Lasso’s findings show a measurable rate of sensitive data exposure, which is enough to justify control design rather than awareness-only programmes. The field should stop framing this as a future AI problem and start treating it as a present enterprise data-handling discipline. The practitioners who win here will govern the boundary, not the novelty.
From our research library:
- Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.
What this signals
Prompt leakage is becoming a control-plane issue for enterprise AI. The practical question is no longer whether employees will use GenAI tools, but whether security teams can govern the content that reaches them. That shifts the programme from awareness campaigns toward enforceable disclosure controls at the point of use.
Shadow LLM widens the policy gap. Once employees spread across sanctioned and unsanctioned tools, a single chatbot policy is not enough. Discovery and content controls have to follow the user across the whole GenAI surface, or the organisation will keep missing the same leakage pattern in different interfaces.
For practitioners
- Define prompt disclosure policy Spell out which classes of data cannot be entered into GenAI tools, including credentials, source code, internal URLs, IP addresses, MAC addresses, personal data, and payment data.
- Deploy continuous GenAI discovery Build a live inventory of approved and shadow GenAI tools so policy can be enforced across the actual user surface, not only the sanctioned chatbot.
- Add pre-submission content scanning Inspect prompts and attached files before they reach GenAI systems so risky disclosures can be blocked before they leave the user session.
- Separate business use cases by data sensitivity Route code generation, document summarisation, customer support, and research tasks through different controls based on the sensitivity of the data involved.
Key takeaways
- Employee prompt behaviour, not the model itself, is the main exposure path in this study.
- Sensitive content shows up in code, network, and personal-data prompts often enough to justify governance controls.
- The most effective response is to govern disclosure at the prompt boundary and enforce it across all GenAI tools.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI09 — Human-Agent Trust Exploitation | Users trust conversational AI with sensitive data, creating prompt-level disclosure risk. |
| Recommendation — Treat prompt submission as a trust boundary and block risky disclosures before the model processes them. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Prompts expose credentials and secrets directly, which matches the core leakage pattern. |
| Recommendation — Scan prompts for secrets and prevent any submission that contains credentials or tokens. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article is fundamentally about governing employee use of GenAI across the organisation. |
| Recommendation — Assign ownership for GenAI disclosure policy and enforcement across business and security teams. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-rest is protected | Prompted data may be stored or logged externally, so data protection remains central. |
| Recommendation — Extend data protection controls to GenAI prompt handling and associated logs. | ||
| MITRE ATT&CK | TA0006;TA0007 — Credential Access; Discovery | The article describes credential exposure and network discovery risks arising from prompt content. |
| Recommendation — Map prompt leakage to credential access and discovery tactics when triaging GenAI abuse. | ||
Key terms
- Prompt Leakage: The unintended exposure of user prompts, system prompts, or tool output from an AI runtime. In NHI terms, prompt leakage matters because those strings often carry sensitive instructions, credentials, or business context, and they may be stored in memory, logs, or exported artifacts.
- Shadow LLM: Shadow LLM refers to undiscovered or unmanaged GenAI tools used inside an organisation. It creates governance blind spots because security teams cannot apply policy, logging, or data controls to tools they have not inventoried, especially when employees use personal accounts or browser-based access paths.
- Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
- Disclosure Boundary: A disclosure boundary is the point where permitted internal access becomes an external share, export, or secondary use of data. In healthcare, these boundaries matter because privacy failures often happen when identity controls allow copying or forwarding PHI beyond the original approved purpose.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 9, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org