---
title: "Prompt Leakage"
description: "Prompt leakage is the unintended disclosure of sensitive data through the prompts you send to AI models. The dominant exposure mode in regulated industries — and how to stop it."
url: "https://sonomos.ai/glossary/prompt-leakage/"
source: "https://sonomos.ai/glossary/prompt-leakage/"
---

# Prompt Leakage

The unintended disclosure of sensitive information through the content of a prompt sent to an AI model.

## In depth

Prompt leakage happens when a user includes sensitive material — client identifiers, source code, financial data, internal strategy — inside a prompt to a third-party AI service. Once the prompt is transmitted, the data is on someone else's servers, may be retained for training or abuse monitoring, and is reachable by the provider's staff under their own access controls. Prompt leakage is the dominant form of AI-related data exposure in regulated industries because the data path is invisible: there is no upload dialog, just a chat box.

## Examples

- Pasting a draft contract with party names into ChatGPT to ask for a redline.
- Asking a coding assistant to refactor a function that contains a hard-coded API key.
- Sharing a deal memo with a generative model to produce a board summary.

## How Locke handles prompt leakage

Locke prevents prompt leakage by inspecting the text in your composer before submission. Detection runs locally; if anything matches a sensitive pattern, the traffic-light widget turns yellow or red and Locke can transform the data before the request leaves your machine.

[See the product](https://sonomos.ai/locke/)

## Related terms

- Privacy Layer for AI

  A control point between a user and an AI service that detects, transforms, or blocks sensitive data before it reaches the model.
- Data Masking

  Replacing sensitive values with realistic-looking substitutes so the data remains usable while the originals never leave the device.
- Tokenization

  Replacing a sensitive value with a non-sensitive token that maps back to the original through a separate, controlled lookup.

## Reading on this topic

- [Does ChatGPT Save Your Prompts? What OpenAI Actually Retains in 2026](https://sonomos.ai/blog/does-chatgpt-save-your-prompts-2026/)
- [Prompt Injection Explained: How Attackers Use AI Models to Steal Your Data](https://sonomos.ai/blog/prompt-injection-explained-attacks-defenses/)
- [AI Data Leakage: 7 Ways Sensitive Information Escapes to LLMs (and How to Stop It)](https://sonomos.ai/blog/ai-data-leakage-7-ways-sensitive-info-escapes-to-llms/)