DEFINITION
Prompt Leakage
The unintended disclosure of sensitive information through the content of a prompt sent to an AI model.
In depth
Prompt leakage happens when a user includes sensitive material — client identifiers, source code, financial data, internal strategy — inside a prompt to a third-party AI service. Once the prompt is transmitted, the data is on someone else's servers, may be retained for training or abuse monitoring, and is reachable by the provider's staff under their own access controls. Prompt leakage is the dominant form of AI-related data exposure in regulated industries because the data path is invisible: there is no upload dialog, just a chat box.
Examples
- Pasting a draft contract with party names into ChatGPT to ask for a redline.
- Asking a coding assistant to refactor a function that contains a hard-coded API key.
- Sharing a deal memo with a generative model to produce a board summary.
How Locke handles prompt leakage
Locke prevents prompt leakage by inspecting the text in your composer before submission. Detection runs locally; if anything matches a sensitive pattern, the traffic-light widget turns yellow or red and Locke can transform the data before the request leaves your machine.
See the productRelated terms
- Privacy Layer for AI
A control point between a user and an AI service that detects, transforms, or blocks sensitive data before it reaches the model.
- Data Masking
Replacing sensitive values with realistic-looking substitutes so the data remains usable while the originals never leave the device.
- Tokenization
Replacing a sensitive value with a non-sensitive token that maps back to the original through a separate, controlled lookup.
