RUBIKSCORPAI bots
Why a chatbot can leak private data
Bots leak when they can reach more data than they need, or when instructions can be talked around. Customer details, internal notes and system prompts have all been exposed this way in real deployments.
Enforce permissions before information reaches the model
Map the data the chatbot can retrieve and the tools it can call. Identify customer records, internal notes, credentials and other sensitive fields. Review the access rules for the signed-in user at every retrieval and tool step. Instructions telling a model to keep a secret cannot replace application-level authorization. Test only systems and data you are authorized to assess, using synthetic records wherever possible.
What to check
- Create two test accounts with different permissions and try to retrieve each other’s records.
- Inspect retrieval filters, tool arguments, caches and conversation history for cross-account mixing.
- Check application logs and third-party processing settings for unnecessary sensitive content.
What to change
Reduce the data available to each tool and request. Enforce account and record access on the server. Redact unnecessary fields before model processing and keep credentials outside prompts. Prevent model output from selecting an arbitrary account or bypassing a permission check. Establish a response procedure for a suspected exposure.
How to evaluate the result
Use explicit pass/fail tests for unauthorized access. Record which data boundaries were assessed and which were outside scope. Review both direct answers and side channels such as generated links, tool errors and export functions.
What the result does not establish
A clean test run covers the scenarios tested. Changes to data sources, permissions or integrations can introduce new exposure paths, so access tests belong in the release process.
Further reading
Want us to fix this for you?
A leak check is part of every audit we run. Register and we’ll test what your bot can reveal and help you close the gaps.