Sensitive-information disclosure is the accidental or unauthorized exposure of secrets, private data, or internal content. In cyber security, this can include API keys, passwords, customer records, source code, system prompts, or internal documents. Even when no system is “hacked” in the classic sense, exposed information can still give attackers what they need to move deeper into a network.
This matters because disclosure often turns a small mistake into a larger incident. Public AI services are a common example: a chat tool may reveal files it can access, leak internal instructions, or return data from connected systems if access controls are weak. Attackers look for these weaknesses through probing, prompt injection, misconfigured storage, and overly broad permissions. Defenders reduce the risk by limiting what services can reach, enforcing least privilege, filtering sensitive output, and monitoring for accidental leaks.