OWASP Top 10 for LLM Applications, 2025
LLM02: Sensitive Information Disclosure
Sensitive information disclosure is when a model, or the application around it, exposes data it should keep private. OWASP lists personal data, financial details, health records, confidential business data, security credentials and legal documents, and it also counts proprietary training methods and source code.
Sensitive Information Disclosure in more detail
The data can leave through the model's output, and users may type sensitive data into a prompt that later reappears in a response. Restrictions in the system prompt on what the model may return help, but they can be bypassed through prompt injection or other methods, so the control cannot live only in the prompt. In our directory, data protection, guardrail, AI-SPM, agent security, red teaming and governance tools are all scored on how they address it.
The risk and its name come from OWASP; the summary, examples and controls on this page are our plain-English reading of OWASP's page. Source: Source, checked October 21, 2026: genai.owasp.org (opens in a new tab)
How it shows up
- The model repeats personal data from a conversation, a document or its training data in a later answer.
- Poorly configured outputs reveal proprietary algorithms or internal data.
- A response includes confidential business information nobody meant to share.
- A user pastes customer records into a prompt without knowing the data may come back out.
Controls that reduce it
- Scrub or mask sensitive content before it is used in training, and validate inputs strictly.
- Apply least privilege so users and processes reach only the data they need, including the external sources the model can read.
- Use tokenization and pattern-based redaction on sensitive content before the model processes it.
- Limit how far users can override system-level settings, and avoid leaking details through errors.
- Write clear policies on data retention and use, and teach users what not to enter.
- Consider privacy techniques such as federated learning and differential privacy where the data justifies the cost.
Controls reduce risk, they do not remove it
No single control covers sensitive information disclosure on its own. Combine controls, and treat any tool as one layer.
Categories that address it
Our analysisThese are the directory categories whose tools we score on this risk. The mapping is our analysis.
Layers that address this risk
Our AI security layers are an editorial model, not a standard. Source states means OWASP's own text for LLM02 names the control the layer delivers. Our analysis means we drew the link.
- L1 Governance and risk Source states
- L2 Discovery and posture Our analysis
- L4 Testing and red teaming Our analysis
- L5 Data protection Source states
- L6 Runtime guardrails Source states
Tools mapped to LLM02
Our analysis64 tools are mapped. Each tool is mapped only where a documented capability supports it. Open a tool page to see the capability and its source. Coverage Score compares tools within one category.
| Tool | Type | Deployment | Pricing model | OWASP risks | Coverage Score | Last reviewed |
|---|---|---|---|---|---|---|
| garakNVIDIA · Red teaming | Open sourceApache-2.0 |
| Free |
| 82 out of 100 | |
| GiskardGiskard AI · Red teaming | Open sourceApache-2.0 |
| Freemium |
| 81 out of 100 | |
| PromptfooOpenAI (Promptfoo) · Red teaming | Open sourceMIT |
| Freemium |
| 80 out of 100 | |
| DefenseClawCisco · Agent security | Open sourceApache-2.0 |
| Free |
| 76 out of 100 | |
| NeMo GuardrailsNVIDIA · Guardrails | Open sourceApache-2.0 |
| Free |
| 76 out of 100 | |
| AugustusPraetorian · Red teaming | Open sourceApache-2.0 |
| Free |
| 75 out of 100 | |
| PyRITMicrosoft · Red teaming | Open sourceMIT |
| Free |
| 73 out of 100 | |
| Docker MCP GatewayDocker · Agent security | Open sourceMIT |
| Free |
| 72 out of 100 | |
| Agentic RadarZscaler (SPLX) · Red teaming | Open sourceApache-2.0 |
| Free |
| 71 out of 100 | |
| DeepTeamConfident AI · Red teaming | Open sourceApache-2.0 |
| Free |
| 71 out of 100 | |
| ProtectoProtecto · Data protection | Commercial |
| Paid |
| 70 out of 100 | |
| agentgatewayagentgateway (a Series of LF Projects, LLC) · Agent security | Open sourceApache-2.0 |
| Free |
| 69 out of 100 | |
| PortkeyPalo Alto Networks (Portkey) · Guardrails Now Prisma AIRS AI Gateway | Open sourceMIT |
| Freemium |
| 69 out of 100 | |
| SpikeeReversec · Red teaming | Open sourceApache-2.0 |
| Free |
| 69 out of 100 | |
| PresidioData Privacy Stack · Data protection | Open sourceMIT |
| Free |
| 67 out of 100 | |
| Kong AI GatewayKong · Guardrails | Open sourceApache-2.0 |
| Usage-based |
| 65 out of 100 | |
| ContextForgeIBM · Agent security | Open sourceApache-2.0 |
| Free |
| 64 out of 100 | |
| LiminaLimina · Data protection Now Limina | Commercial |
| Freemium |
| 64 out of 100 | |
| OpenShellNVIDIA · Agent security | Open sourceApache-2.0 |
| Free |
| 64 out of 100 | |
| Evo AI-SPMSnyk · AI-SPM | Commercial |
| Usage-based |
| 64 out of 100 | |
| Strands BoxAmazon Web Services · Agent security | Open sourceApache-2.0 |
| Free |
| 64 out of 100 | |
| Bedrock GuardrailsAmazon Web Services · Guardrails | Commercial |
| Usage-based |
| 60 out of 100 | |
| Cisco Skill ScannerCisco · Agent security | Open sourceApache-2.0 |
| Free |
| 60 out of 100 | |
| Tonic TextualTonic.ai · Data protection | Commercial |
| Usage-based |
| 60 out of 100 | |
| Lakera GuardCheck Point (Lakera) · Guardrails Now Check Point AI Guardrails | Commercial |
| Not published |
| 57 out of 100 | |
| ARTLF AI & Data Foundation · Red teaming | Open sourceMIT |
| Free |
| 55 out of 100 | |
| AgentCore PolicyAmazon Web Services · Agent security | Commercial |
| Usage-based |
| 55 out of 100 | |
| Holistic AIHolistic AI · Governance | Commercial |
| Not published |
| 55 out of 100 | |
| Defender AI-SPMMicrosoft · AI-SPM | Commercial |
| Included with platform |
| 55 out of 100 | |
| Wiz AI-SPMGoogle (Wiz) · AI-SPM | Commercial |
| Not published |
| 54 out of 100 | |
| AI Red Teaming AgentMicrosoft · Red teaming | Commercial |
| Usage-based |
| 53 out of 100 | |
| b3 benchmarkCheck Point (Lakera) and UK AI Security Institute · Red teaming | Open sourceMIT |
| Free |
| 53 out of 100 | |
| Noma SecurityNoma Security · AI-SPM | Commercial |
| Not published |
| 53 out of 100 | |
| Gray SwanGray Swan · Red teaming | Commercial |
| Not published |
| 52 out of 100 | |
| HarmonicHarmonic Security · Data protection | Commercial |
| Not published |
| 52 out of 100 | |
| Google Cloud Sensitive Data ProtectionGoogle Cloud · Data protection Renamed | Commercial |
| Usage-based |
| 51 out of 100 | |
| SPLXZscaler (SPLX) · Red teaming | Commercial |
| Contact sales |
| 51 out of 100 | |
| Adversa AIAdversa AI · Red teaming | Commercial |
| Not published |
| 50 out of 100 | |
| Agent GatewayGoogle Cloud · Agent security | Commercial |
| Not published |
| 50 out of 100 | |
| AQtive Guard AI-SPMSandboxAQ · AI-SPM | Commercial |
| Not published |
| 50 out of 100 | |
| SkyflowSkyflow · Data protection | Commercial |
| Not published |
| 50 out of 100 | |
| Purview DSPM for AIMicrosoft · Data protection Renamed | Commercial |
| Usage-based |
| 49 out of 100 | |
| StraikerStraiker · Agent security | Commercial |
| Not published |
| 49 out of 100 | |
| Zscaler AI-SPMZscaler · AI-SPM | Commercial |
| Not published |
| 49 out of 100 | |
| Cloudflare AI GatewayCloudflare · Guardrails | Commercial |
| Freemium |
| 48 out of 100 | |
| Pangea AI GuardCrowdStrike (Pangea) · Guardrails | Commercial |
| Not published |
| 48 out of 100 | |
| Pillar SecurityPillar Security · Agent security | Commercial |
| Not published |
| 48 out of 100 | |
| Cisco AI DefenseCisco · Guardrails | Commercial |
| Not published |
| 47 out of 100 | |
| OneTrust AI GovernanceOneTrust · Governance | Commercial |
| Contact sales |
| 46 out of 100 | |
| Lakera RedCheck Point (Lakera) · Red teaming | Commercial |
| Contact sales |
| 45 out of 100 | |
| NightfallNightfall · Data protection | Commercial |
| Contact sales |
| 45 out of 100 | |
| Model ArmorGoogle Cloud · Guardrails | Commercial |
| Usage-based |
| 44 out of 100 | |
| Prisma AIRSPalo Alto Networks · AI-SPM | Commercial |
| Not published |
| 44 out of 100 | |
| AliceAlice · Guardrails | Commercial |
| Not published |
| 42 out of 100 | |
| Radware LLM FirewallRadware · Guardrails | Commercial |
| Not published |
| 41 out of 100 | |
| Orca AI-SPMOrca Security · AI-SPM | Commercial |
| Not published |
| 40 out of 100 | |
| Lasso SecurityLasso Security · Guardrails | Commercial |
| Not published |
| 39 out of 100 | |
| MCP Server PortalsCloudflare · Agent security | Commercial |
| Not published |
| 38 out of 100 | |
| HiddenLayer AIDRHiddenLayer · Guardrails | Commercial |
| Not published |
| 37 out of 100 | |
| WitnessAIWitnessAI · Data protection | Commercial |
| Not published |
| 36 out of 100 | |
| CalypsoAIF5 (CalypsoAI) · Guardrails Now F5 AI Guardrails | Commercial |
| Not published |
| 32 out of 100 | |
| Firewall for AICloudflare · Guardrails Now AI Security for Apps | Commercial |
| Contact sales |
| 29 out of 100 | |
| Prompt SecuritySentinelOne (Prompt Security) · Guardrails | Commercial |
| Not published |
| 29 out of 100 | |
| LLM GuardPalo Alto Networks (Protect AI) · Guardrails Archived | Open sourceMIT |
| Free |
| 66 out of 100 |
No tools match these filters. Clear a filter to see more.
Why each tool is mapped
- garak: Runs data leakage probes against a target model.
- Giskard: Homepage lists data disclosure among the security issues it looks for.
- Promptfoo: Documents plugins that test whether a target reveals PII, directly, across sessions, through social engineering or through API and database access.
- DefenseClaw: The same inspection looks for data exfiltration patterns in prompts, completions and tool calls.
- NeMo Guardrails: Detects and masks personal data in inputs, outputs and retrieved content.
- Augustus: Lists data extraction as one of its attack categories.
- PyRIT: Ships scenarios that cover data leakage against a target system.
- Docker MCP Gateway: The --block-secrets option scans tool-call arguments and responses for secret-like values.
- Agentic Radar: The test command checks for PII leakage.
- DeepTeam: Tests a target for PII leakage.
- Protecto: Detects sensitive data and tokenizes or masks it before it reaches a model.
- agentgateway: Regex prompt guards can mask patterns such as credit card numbers and emails in LLM requests and responses.
- Portkey: A redaction guardrail masks PII in requests before the model sees it, and an output guardrail checks responses for PII leaks.
- Spikee: Its stated focus includes data exfiltration threats against LLM applications.
- Presidio: Detects and anonymizes personal data in text, which can be applied before text reaches a model.
- Kong AI Gateway: The AI Sanitizer redacts PII before prompts reach the upstream provider.
- ContextForge: The plugin docs name a PII filter plugin that detects and masks personal data in gateway traffic.
- Limina: Detects and redacts personal, health and payment data in text before it is passed on.
- OpenShell: Credentials reach only approved endpoints, so the agent never holds a real credential that it could leak.
- Evo AI-SPM: Model risk tests include PII extraction, secret theft and private data leakage, which Snyk maps to LLM02.
- Strands Box: An egress gateway adds credentials to permitted requests, so the agent never holds secrets it could leak.
- Bedrock Guardrails: Sensitive information filters block or mask PII in inputs and responses.
- Cisco Skill Scanner: Flags data exfiltration patterns in skill files; it is a pre-load scan, not a runtime data control.
- Tonic Textual: Detects and redacts sensitive entities, including before text enters LLM prompts.
- Lakera Guard: Data leakage defenses protect personal and other sensitive data.
- ART: Model inversion and membership inference attacks test the training data leakage OWASP LLM02 describes, on classic ML models rather than LLMs.
- AgentCore Policy: A suppressOutput policy can withhold a tool response when a sensitive information guardrail finds items such as an SSN.
- Holistic AI: Automated tests cover privacy, which can surface sensitive information exposure.
- Defender AI-SPM: Flags reachable AI endpoints and data exposure paths that could lead to sensitive data leaving.
- Wiz AI-SPM: Data security posture for AI detects sensitive training data and leakage risks.
- AI Red Teaming Agent: Agent red teaming probes for leakage of financial, medical and personal data in cloud runs.
- b3 benchmark: Data exfiltration is one of the attack objectives it covers.
- Noma Security: Runtime controls can mask sensitive data when an agent action would expose it.
- Gray Swan: Shade's data leakage category tries to extract training data or sensitive information.
- Harmonic: Detects sensitive data in prompts to AI tools and coaches, warns or blocks before it is shared.
- Google Cloud Sensitive Data Protection: Detects and de-identifies sensitive data, including in LLM prompt inputs, before it is stored or shared.
- SPLX: Docs name a Context Leakage probe among the probe runs.
- Adversa AI: Data leakage is named among its vulnerability categories.
- Agent Gateway: The same optional screening looks for data leakage in prompts and tool responses.
- AQtive Guard AI-SPM: Gateway guardrails block or mask PII and secrets such as API keys before a request reaches the model provider.
- Skyflow: Keeps sensitive values in a vault, de-identifies detected PII and states that it prevents sensitive data from leaking into models and prompts.
- Purview DSPM for AI: Detects sensitive data in prompts and responses and applies DLP policies that warn or block sharing with AI apps.
- Straiker: Monitors for exfiltration of PII, regulated data and secrets.
- Zscaler AI-SPM: Alerts on access to sensitive data and on regulated data used in AI training, where disclosure starts.
- Cloudflare AI Gateway: DLP scans prompts and responses for PII and other sensitive data.
- Pangea AI Guard: Recipes redact PII and sensitive data from AI interactions.
- Pillar Security: Enforces data privacy for PII, PHI and secrets at runtime.
- Cisco AI Defense: Runtime privacy controls cover PII, PCI and PHI leakage.
- OneTrust AI Governance: Policies can redact sensitive data in prompts and outputs, and the AI Guard SDK identifies sensitive data in prompts and responses in line.
- Lakera Red: Security testing covers data leakage.
- Nightfall: Inspects prompts, tool calls and responses and detects sensitive data such as PII, PCI and PHI.
- Model Armor: Sensitive Data Protection detects and can redact PII and other sensitive data.
- Prisma AIRS: The runtime module is described as detecting and blocking AI-specific attacks and data loss.
- Alice: PII masking is a named example of a policy detector.
- Radware LLM Firewall: Detects PII in prompts and responses and blocks extraction attempts.
- Orca AI-SPM: Shows which sensitive datasets AI systems can access and helps lock down that exposure.
- Lasso Security: Data loss prevention policies can block or mask sensitive data.
- MCP Server Portals: Optional Gateway routing applies DLP scanning to portal traffic; blocked requests and responses return as errors.
- HiddenLayer AIDR: Inline controls can block or redact sensitive data exposure.
- WitnessAI: Redacts or tokenizes sensitive data in real time before it reaches an AI service.
- CalypsoAI: PII leakage controls and semantic data security limit sensitive data exposure.
- Firewall for AI: PII detection flags personal data in incoming prompts.
- Prompt Security: Sensitive data is redacted and outputs are scrubbed under policy.
- LLM Guard: Anonymize and Secrets scanners keep personal data and credentials out of prompts.