Unauthorized Document Exfiltration

RAG answers or agent tools leak restricted documents to users who lack ACL entitlement.

Impact

Confidential IP, PII, or regulated records leave the trust boundary through natural-language answers.

Why this severity

Impact High × Likelihood Medium = High

Impact high: confidential data leaves the boundary. Likelihood medium: zero-click exfiltration was demonstrated against M365 Copilot and Slack AI, but not catalogued as an in-the-wild incident.

Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood Medium: Publicly demonstrated against real products or in peer-reviewed research, or seen in the wild only with a prior foothold such as stolen credentials.

Method: OWASP Risk Rating Methodology

Evidence

Demonstration: EchoLeak: Zero-Click Prompt Injection Targeting M365 Copilot for Data Exfiltration (MITRE ATLAS case study AML.CS0059, 2025)
Demonstration: Data Exfiltration from Slack AI via Indirect Prompt Injection (MITRE ATLAS case study AML.CS0035, 2024)

Exploits

Missing Document ACLs Vulnerability · High severity
Over-Privileged Retrieval Indexing Vulnerability · High severity

Mitigated by

Document-Level Access Enforcement Guardrail · Fixes high risks
Output Filtering & PII Anonymization Guardrail · Fixes critical risks

Remediation

Enforce document-level ACLs at retrieval time, not only at UI login.
Redact PII in outputs with policy-aware filters.
Block citation of documents outside the requester's clearance.

How to verify

Cross-tenant retrieval tests must return empty hit sets.
PII canaries in indexed docs must not appear in unauthorized answers.

Framework mapping

OWASP Top 10 for LLM Applications 2025

LLM02:2025 Sensitive Information Disclosure
LLM08:2025 Vector and Embedding Weaknesses

MITRE ATLAS

AML.T0057 LLM Data Leakage
AML.T0085.000 Data from AI Services: RAG Databases

NIST AI RMF 1.0

MEASURE 2.10 Privacy risk of the AI system is examined and documented