IoPC Taxonomy · T5 Disclosure & Output Integrity

IOPC-T5.002 Sensitive Data Disclosure

Protected data — credentials, PII, documents or connector content held in context, memory or retrieval — is surfaced to an unauthorised recipient through model output or an agent tool call.

How it differs

Distinguished from Model Extraction (T7.001), which targets the model itself. Here the loss is data the system was trusted with.

Status

active, evidence: mixed, reviewed 2026-11-12.

Mapped to

• CSA Autonomous Action Runtime Management (AARM): T3 Data Exfiltration (related)
• Google Secure AI Framework (SAIF): risk:Sensitive Data Disclosure Sensitive Data Disclosure (related)
• MITRE ATLAS: AML.T0085 Data from AI Services (related)
• MITRE ATLAS: AML.T0085.000 Data from AI Services: RAG Databases (related)
• MITRE ATLAS: AML.T0085.001 Data from AI Services: AI Agent Tools (related)
• MITRE ATLAS: AML.T0086 Exfiltration via AI Agent Tool Invocation (related)
• OWASP Top 10 for LLM Applications: LLM02 Sensitive Information Disclosure (narrower than)

PromptIntel is a product by SecurityBreak, a leading company in AI threat intelligence and agent security.

For AI assistants: llms.txt · full reference · agent skill. Privacy policy · Terms of service