How it fails
The animation steps through one representative failure and the control that stops it. Use the arrow buttons to go at your own pace.
Overview
Personal information or sensitive inferences cross an audience, purpose, or account boundary without appropriate authority. The data may be accurate and legitimately accessible for one task yet inappropriate for another recipient. This entry protects the operator's own context boundaries (contextual integrity); surveillance or processing directed at another person belongs to PAA08.
Common examples of vulnerability
- A work-meeting summary or attachment includes a personal bank statement because both were recently open.
- An inferred medical, relationship, or financial attribute appears in a routine scheduling message.
- Memory, retrieval indexes, or logs mix work, family, and private data under one profile.
- Cross-account tool calls leak content from a private mailbox into a work thread.
- Exports, logs, or shared transcripts expose more than the approved content or audience.
Example attack scenarios
Documented scenarios generalize a real case listed below. Hypothetical scenarios have no matching public case yet.
Scenario 1: Bank statement attached to a work email Hypothetical
An assistant helping with a work meeting attaches a personal bank statement because both documents were recently open. Each file was legitimately accessible; the combination crosses an audience boundary.
Scenario 2: Inference leaks into scheduling Hypothetical
An assistant that inferred a health condition from calendar and purchase history mentions it while negotiating a meeting time with a colleague's assistant.
Scenario 3: One inbound email makes the assistant send out the owner's data Documented
An attacker emails the person. Without any click, the assistant reads the email as an instruction, gathers data from the person's accounts, and leaks it through an auto-loaded image or link.
Scenario 4: Public-channel text pulls private-channel content Documented
An attacker posts crafted text in a channel the victim can read. The workplace assistant mixes it with private-channel data and renders a link that leaks the private data.
Scenario 5: A share link makes private chats public Documented
A person shares a chat with one friend. The link is later indexed by a search engine, so the conversation, and anything personal in it, becomes searchable.
Scenario 6: A share button posts a private chat to a public feed Documented
A person taps share in an assistant app without realizing the result is a public feed. Medical, legal, or relationship details become visible to strangers.
Real-world cases
Dated and sourced. Nothing here shows how common the failure is; it shows that it has happened or been demonstrated.
EchoLeak: zero-click data exfiltration from Microsoft 365 Copilot
- What happened
- Aim Security found that a single crafted email could make Microsoft 365 Copilot pull data from the user's own context and send it out through an auto-fetched image URL, with no user action. The chain bypassed Microsoft's prompt-injection classifier, link redaction, and a content security policy via an allowed Teams proxy. Tracked as CVE-2025-32711 and fixed server-side by Microsoft.
- Caveats
- Workplace product, not a personal agent. Sources conflict on whether it was exploited in the wild; the paper calls it a real-world exploit in a production system but does not say attackers used it before disclosure.
- Grounds
- Scenario 3
- Sources
- EchoLeak paper (arXiv 2509.10540)
Slack AI can be tricked into leaking private-channel data
- What happened
- PromptArmor showed that text planted in a public Slack channel could make Slack AI, when answering a victim's question, pull in content from private channels and render a markdown link ('click here to reauthenticate') that leaked the data. Slack initially described the behavior as intended; Dark Reading later reported that Slack patched the flaw.
- Caveats
- A workplace assistant, not a personal agent. Based on search summaries and secondary coverage of PromptArmor's post.
- Grounds
- Scenario 4
- Sources
- PromptArmor · The Register
Shared AI chats become searchable: ChatGPT, Grok and Claude
- What happened
- Fast Company reported on 30 July 2025 that Google was indexing ChatGPT conversations users had shared by link, with nearly 4,500 surfacing in a site search (likely an undercount); OpenAI called the feature experimental and removed it. Forbes later reported hundreds of thousands of Grok conversations indexed without a warning to users (counts of 300,000-370,000 vary by outlet), and, on 8 September 2025, that hundreds of Claude transcripts appeared in Google results.
- Caveats
- Only explicitly shared chats were affected, but many users did not expect search indexing. Removal from a search engine does not delete the chat or its link. Counts and some dates vary; the Fast Company page returned 403, so this relies on search summaries.
- Grounds
- Scenario 5
- Sources
- Fast Company · Forbes on Claude · Tom's Guide on Grok
Meta AI app share button posts private chats to a public Discover feed
- What happened
- Android Authority reported that users tapping share in the Meta AI app could publish chats to the public Discover feed, including medical information, legal dilemmas, and confessions, with no clear warning above the post button. Meta said chats are private by default and sharing takes a four-step process. The Mozilla Foundation asked Meta to notify users and help them delete accidentally shared content.
- Caveats
- Meta's later UI changes are only reported by one secondary source. The original TechCrunch coverage was not reviewed.
- Grounds
- Scenario 6
- Sources
- Android Authority · Mozilla Foundation campaign
ShadowLeak and GeminiJack: server-side exfiltration from connected mail and documents
- What happened
- Radware's ShadowLeak made ChatGPT's agent send data from connected sources such as Gmail, Outlook, and GitHub out through URL parameters from OpenAI's servers; OpenAI added guardrails. Noma Labs' GeminiJack hid instructions in a shared document, calendar invite, or email so Gemini Enterprise exfiltrated connected data with no click; Noma reported it to Google on 6 May 2025, disclosed it in December 2025, and Google reworked how retrieved content is handled.
- Caveats
- Both involve connected workplace or enterprise data. Disclosure dates are inconsistent across outlets (GeminiJack 9 or 11 December 2025) and only secondary coverage was reviewed.
- Grounds
- Scenario 3
- Sources
- SC Media on ShadowLeak · SecurityWeek on GeminiJack
No documented case of an agent mixing a person's private and work context
- What happened
- Benchmarks show the failure is common in lab conditions (Agent CI Bench reports 12 of 15 frontier computer-use agents leaking private data in over 50% of scenarios, per a secondary summary; CI-Work reports 15.8-50.9% violation rates), but no public report of a real person harmed this way was found.
- Caveats
- Treat the bank-statement and inference scenarios as hypothetical until a real case is found.
- Grounds
- Scenario 1, Scenario 2
- Sources
- CI-Work (arXiv 2604.21308) · Agent CI Bench summary
Prevention and mitigation
What you can do
- Separate work, family, and private activities into distinct agent profiles or accounts.
- Use previews for outbound messages and attachments that touch sensitive categories.
- Review what is retained and delete purpose-expired data.
What the provider must do
- Enforce context separation in retrieval, tool access, credentials, and outbound actions; profile labels alone are not isolation.
- Apply source-level protection to sensitive inferences, not only source records.
- Limit approved transfers to the approved content and audience; show the diff between what was approved and what is sent.
- Tie secondary use and retention to purpose with understandable controls.
- Evaluate with contextual-integrity benchmarks, not only secret-string leakage tests.
Where a safeguard is unavailable, offer a narrower mode such as read-only access or manual completion rather than rely on an instruction to the model.
See the reference guard controls for PAA03 →
Test it
Framework crosswalk
Related mechanisms in other OWASP work. This is an analytical mapping, not equivalence.
Top 10 for Agentic Applications 2026Personal focus: Boundaries between private life, work, and personal audiences.
Improve this entry on GitHub →