LLM security in 2025 is now a data and identity problem

At a glance

What this is: Sentra argues that LLM security in 2025 has moved from prompt injection toward data exposure, identity misuse, and excessive permissions across training and inference workflows.

Why it matters: This matters because LLM programmes now expand the security boundary into data, identity, and access governance, which means IAM, DSPM, and AI controls must work together.

Context

Large language model security is no longer just a model-output problem. Once LLMs are connected to internal data stores, fine-tuned on proprietary content, and allowed to call tools, the real risk becomes who and what can reach sensitive data, under what identity, and with what privilege.

The article’s core point is that the security model has shifted from point-in-time review to continuous governance across the LLM lifecycle. That is relevant to IAM, NHI, and agentic AI programmes because the same controls that govern human access now need to constrain applications, service identities, and AI-driven workflows.

Key questions

Q: What breaks when LLMs are given access to data without tight identity controls?

A: The main failure is that the model, its app, or its supporting service identity can reach more data than the use case requires. That turns retrieval and tool use into hidden access paths, so sensitive content can be exposed even when the model itself appears well governed. Least privilege has to apply to the identities around the model, not just to users.

Q: Why do retrieval-augmented LLMs increase data exposure risk?

A: RAG increases risk because the model can dynamically pull from internal sources at inference time, which expands the trust boundary beyond the base model. If source permissions are broad, the model can surface data that would otherwise remain restricted. The issue is not only prompt quality, but whether retrieval is authorised, bounded, and monitored.

Q: What are the signs that an AI agent has too much workflow context?

A: Common signs include agents repeatedly searching across unrelated files, pulling in tickets that are not relevant to the change, citing vague summaries, or making edits that satisfy code mechanics but miss business intent. If the agent needs broad exploration to answer simple change questions, context boundaries are too loose.

Q: Should organisations prioritise data governance or model governance for LLM security?

A: Data governance should come first when the dominant risk is exposure of sensitive training or retrieval data, because a secure model cannot compensate for uncontrolled inputs and repositories. Model governance still matters, but in 2025 the practical failure mode often starts with data access, classification, and lifecycle controls around the LLM.

Technical breakdown

RAG expands the inference-time trust boundary

Retrieval-augmented generation connects a model to external stores at the moment of inference, which means the security question is no longer only what the model was trained on, but what it can fetch right now. That widens the trust boundary across data repositories, vector indexes, and application-layer permissions. If retrieval is loosely governed, the model becomes an indirect path to sensitive content even when the base model itself is stable. The governance challenge is not just model quality; it is access scope across the retrieval path.

Practical implication: Treat retrieval permissions as part of the control plane, not an application afterthought.

Fine-tuning creates a durable exposure and poisoning surface

Fine-tuning and continual training on proprietary data increase both the value of the dataset and the impact of any mistake in handling it. Sensitive records embedded in training corpora can leak later through output generation, while manipulated inputs can change model behaviour in ways that are hard to reverse. This is why training data governance is now a security issue, not only a data science issue. The practical problem is that once sensitive or low-quality data is absorbed, the exposure can persist across model versions and downstream integrations.

Practical implication: Apply data classification, cleaning, and lineage controls before content is admitted into training workflows.

Tool-calling and agentic AI turn permissions into actions

When an LLM is allowed to call tools, it stops being only a generator and starts acting through connected systems. That changes the control problem from text safety to delegated authority, because excessive permissions can let a model read, move, or expose data across cloud services and SaaS platforms. In identity terms, the model and its connected services behave like non-human actors that need explicit authorization, lifecycle oversight, and monitoring. The risk is not merely malicious output; it is unintended execution under valid credentials or tokens.

Practical implication: Constrain AI tools with least privilege, scoped credentials, and monitored delegation chains.

Threat narrative

Attacker objective: The attacker or misconfigured system seeks unauthorized access to sensitive data or to manipulate model behaviour and downstream actions.

1. Entry occurs when an LLM workflow is connected to internal data stores, fine-tuning corpora, or tool-calling interfaces without sufficiently tight access scope.
2. Credential or identity abuse follows when excessive permissions allow the model, its app, or its connected machine identity to reach data or systems it should not touch.
3. Impact appears as sensitive data disclosure, poisoned model behaviour, or unintended actions across cloud services and SaaS platforms.

Breaches seen in the wild

• LiteLLM PyPI package breach: LiteLLM PyPI supply chain attack, credentials stolen from users.
• Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

LLM governance has become an identity problem as much as a data problem. The article shows that retrieval, fine-tuning, and tool-calling all depend on identities, permissions, and trust boundaries that were often designed for people, not machines. In practice, the security failure is not just exposure of information but exposure through authorised pathways that were too broad to begin with. Practitioners should govern LLM access the same way they govern other high-risk non-human access paths.

RAG creates a retrieval trust gap that traditional application reviews miss. Once a model can fetch internal content dynamically, the relevant control point moves from model approval to data access authorisation. That means the question is not whether the model is accurate, but whether the retrieval path is constrained to the minimum set of sources required. Practitioners should map retrieval sources to explicit access policy and review them as living entitlements.

Excessive agency is the correct name for one of the article’s most important failure modes. The model is not dangerous because it is intelligent, but because it can act under permissions it should not hold. That is why this topic sits at the intersection of agentic AI security and NHI governance, especially when service identities and API tokens are used to let models do work. Practitioners should treat tool-calling as delegated access that needs approval, scope, and revocation.

LLM training data governance now needs the same discipline that organisations apply to sensitive production data. The article’s focus on data hygiene, policy enforcement, and monitoring reflects a broader market shift toward continuous controls rather than one-time model reviews. The named concept here is model data blast radius: once proprietary or sensitive content enters training, the exposure can persist across outputs, versions, and integrations. Practitioners should design controls to reduce that blast radius before data is admitted.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: Shadow AI and AI Agent Discovery Guide

What this signals

Model data blast radius: once proprietary data is admitted into retrieval or training workflows, the exposure can persist across outputs, versions, and connected applications. That means AI security teams need controls that govern not only the model, but every data source and identity that feeds it.

LLM governance will increasingly be measured by whether organisations can limit the reach of non-human identities in AI workflows. Discovery, classification, and delegated access review are becoming the practical controls that separate controlled use from uncontrolled exposure.

AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.

For practitioners

• Implement continuous data discovery for LLM pipelines Identify where training, retrieval, and prompt data is stored, then classify it continuously so sensitive content does not enter model workflows unnoticed.
• Enforce least privilege for AI tool access Scope every model, app, and machine identity to the minimum data sources and actions required, and separate read access from write or execute permissions.
• Sanitise training datasets before fine-tuning Remove sensitive records, bad labels, and toxic data before training starts, and preserve lineage so changes can be traced back to source material.
• Monitor suspicious identity activity across AI workflows Watch for unusual data access, exfiltration patterns, and unexpected cross-service actions by user, app, or machine identities tied to LLM systems.
• Separate retrieval authorisation from model behaviour Review which stores a model can query, which outputs it can influence, and which downstream systems it can reach so delegated access stays bounded.

Key takeaways

• LLM security has shifted from content filtering to controlling how data, identities, and tools interact across model workflows.
• RAG, fine-tuning, and tool-calling enlarge the attack surface because they extend trust beyond the model into connected data and systems.
• Practitioners need continuous discovery, least privilege, and monitoring to keep sensitive data and delegated actions inside governed boundaries.

Key terms

• Retrieval-augmented Generation: Retrieval-augmented generation is a pattern where an AI model pulls external information before generating output. The security challenge is that access rules can weaken when data is chunked, embedded, cached, or reused, so source permissions may not automatically follow the content into the model's context.
• Excessive agency: A condition where an AI system is given more operational authority than its task requires. The risk is not just poor output. It is that mistakes, manipulation, or compromise can produce destructive actions at machine speed across the systems the agent can reach.
• Training Data Poisoning: Training data poisoning is an attack that corrupts the data an AI model learns from so it produces attacker-influenced results later. The corruption may be inserted during training or at runtime, and the model can appear normal while embedding a hidden failure path in its outputs.
• Data Security Posture Management: Data Security Posture Management, or DSPM, is the continuous discovery and monitoring of where sensitive data lives, how it is exposed, and where policy gaps exist. Its value rises when it feeds remediation rather than generating findings alone, especially in environments where AI expands the number of data paths.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It helps security and identity practitioners connect delegated access, lifecycle control, and governance across modern AI programmes.