AI Security / 2026 Essentials
Keep Sensitive Data Out of Unapproved AI Workflows
Understand what an AI service receives and what its answers might expose.
AI applications can disclose personal information, credentials, or confidential business material through their inputs and outputs. A system prompt saying “keep this private” is not an access-control boundary. Minimise the information supplied and review the complete application path, including connected data sources and generated responses.
What matters
- Classify information before sending it to an external AI service.
- Remove unnecessary identifiers and secrets from prompts, examples, and reference material.
- Verify vendor settings and enforce access controls in the application, not only in instructions.
Practical example: A troubleshooting question includes a sanitised error message instead of a full configuration containing production credentials.
One action today: Inspect one real AI workflow and remove sensitive fields that are not needed for the task.