Gary Cheung · Published 7 May 2025 · 4 min read
At a glance
- The risk: Sensitive information can move into AI workflows through ordinary prompts, connectors, or code assistants without malicious intent.
- The governance implication: Exposure depends on the data path, tool settings, access, retention, and terms; responsibility must be assigned to a business and data owner.
- The leadership takeaway: Approve AI use by data class and purpose, and name who can challenge or stop a workflow when its risk changes.
The business question is straightforward: if an employee puts customer, transaction, code, or strategy data into an AI-enabled workflow, who approved that data path—and who can stop it?
Calling AI “the new insider threat” is a useful provocation, but it is not literal. AI is not an employee. The exposure arises when authorized people or connected systems move information into a workflow whose access, retention, reuse, and onward disclosure have not been assessed. The scenarios below are illustrative; actual data handling depends on each product’s settings and terms.
The Threat Is an Unowned Information Flow
Insider-risk thinking often focuses on intent, access, and behavior. AI adds a different management problem: a legitimate user may act without malicious intent while information crosses a boundary the organization has not governed.
The risk is not proof that a provider trains on prompts. Collection, logging, retention, product-improvement use, and access controls vary by service, configuration, and agreement. Leaders need to verify the specific workflow rather than assume every AI tool is public—or that an enterprise label makes every use safe.
Routine Work Can Move Sensitive Data Across Boundaries
Consider three illustrative situations: a finance employee asks for help with a draft forecast, an HR manager summarizes case notes, or a developer uses a code assistant on proprietary source. These are examples, not claims that specific incidents occurred. Each involves a business decision about which information may enter which service, for what purpose, and under what safeguards.
Potential consequences include a confidentiality breach, contractual or privacy obligations, intellectual-property exposure, or an output reaching people who should not see it. The likely impact depends on the information involved, the service configuration, access to prompts and outputs, and how the organization relies on the result.
Why Existing Controls Can Miss the Decision
A policy that says “use approved AI” cannot govern a workflow the organization has not inventoried. The review needs to cover tools, accounts, browser extensions, connectors, APIs, data sources, and permissions—not just the model name.
NIST’s Generative AI Profile, published on 26 July 2024, describes a voluntary, cross-sectoral resource for managing generative AI risks. OWASP’s 2025 Top 10 for LLM Applications identifies sensitive information disclosure as an application risk. Those sources support treating data exposure as a real governance and technical concern; they do not establish that every prompt is retained, used for training, or made public.
Govern Use by Data Class, Purpose, and Authority
Set boundaries by information class and use case. For each approved workflow, name the business owner and data owner; document the allowed purpose, service, integrations, settings, and retention; and require security, privacy, or legal review where the data or consequence warrants it.
Use data minimization, redaction, access controls, and monitoring that fit the workflow. Check the actual service terms and configuration for retention, training use, deletion, and administrator visibility. These checks are part of due diligence, not assumptions to make from a product label.
Finally, make the escalation path operational. Identify who can pause a connector or workflow immediately, what evidence triggers escalation, and who decides whether service resumes. A policy without clear stop authority leaves the most consequential decision to whoever notices the problem first.
Questions Leaders Should Be Able to Answer
- Which data classes and business uses are approved for each AI workflow, and who accepted the residual risk?
- Can we trace sensitive information through prompts, connected data, logs, outputs, and retention?
- Who can stop the workflow promptly when its provider, configuration, or risk profile changes?
Closing Thought
AI does not need to be an insider for insider-like information risk to emerge. The governance test is whether leaders can see the data path, assign its owner, and stop it before exposure becomes the organization’s problem.
Sources and Further Reading
- NIST, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (26 July 2024) — a voluntary, cross-sectoral risk-management resource.
- OWASP, LLM02:2025 Sensitive Information Disclosure — application-focused risk examples and mitigation themes.
- When Data Becomes the Weakest Link: How AI Amplifies Information Risk
- Secure AI Deployment: 5 Critical Vendor Checks for Prompt Data Privacy
About Gary: Gary Cheung writes about AI governance, information risk, and application security. Contact Gary to discuss a consequential AI decision.
