Yes: sensitive corporate data has been found in prompts and files submitted to AI tools. But available figures do not establish how many developers do this. The practical security question is what information your team submits or gives an AI assistant access to—and which controls apply to each route.
What the available numbers do—and do not—show
Harmonic Security examined one million prompts and 20,000 files submitted to 300 AI tools and AI-enabled SaaS applications between April and June 2025. Axios reported that more than 4% of the sampled prompts and more than 20% of the sampled files contained sensitive corporate data; code was the most common type of sensitive data reported in prompts. The sample came from organizations using Harmonic’s tools, so it is not established as representative of all organizations or developers. These figures show that sensitive material can enter AI services, not how often developers generally paste secrets into them. (Axios, July 31, 2025)
As an Amazon Associate I earn from qualifying purchases.
Repository-secret statistics measure a different problem. They count credentials found in source-control repositories, not information submitted to an LLM.
| Figure | What it measures | What it does not establish |
|---|---|---|
| More than 4% of sampled prompts contained sensitive corporate data | Prompts in Harmonic Security’s April–June 2025 sample of one million prompts submitted to 300 AI tools and AI-enabled SaaS applications | The rate among all developers or organizations |
| More than 20% of sampled uploaded files contained sensitive corporate data | Files in the same Harmonic Security sample of 20,000 submitted files | The rate among all uploaded files or developers |
| More than 39 million secret leaks across GitHub in 2024 | Secrets detected across GitHub, as reported by GitHub in 2025 | Secrets pasted into AI prompts |
| Over one million leaked secrets detected on public repositories in the first eight weeks of 2024 | Secrets found on public repositories during that period | Secrets shared with chatbots or AI agents |
The GitHub figures are useful evidence that exposed credentials are an ongoing repository-security issue, but they cannot be used as a proxy for prompt behavior. See GitHub’s 2025 report on secret leaks and its 2024 report on public repositories.
#1 Best Overall
How AI tools can encounter sensitive information
“Pasting a secret into an LLM” describes one exposure path, not every way an AI feature can encounter company data. Security controls should reflect how the tool actually works.
Direct prompt and file submission
A developer may type credentials, proprietary code, customer information, or internal documents into a chat, or attach a file. The submitted material is then handled under the service’s terms and configuration. A secret included in a prompt is not made safe merely because it is absent from the repository.
Rank #2
- Used Book in Good Condition
Workspace and repository context
A coding assistant may be able to use code or other workspace material to respond. An agent may also have access to tools or take actions. The relevant question is not only what a developer deliberately pastes, but what context and capabilities are available to the assistant for the task.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Credentials committed to source control
An API key or token committed to a repository is a repository leak. Secret scanning and push protection can help detect or block that exposure, but they do not inspect every prompt a developer sends to an external AI service.
Why agent access adds another risk
An AI agent can encounter instructions inside untrusted material, such as content it reads while completing a task. NIST’s Center for AI Standards and Innovation describes agent hijacking as indirect prompt injection: malicious instructions are placed in data an agent may ingest and can lead it to take unintended actions. In a January 2025 evaluation, CAISI added tests involving remote code execution, database exfiltration, and automated phishing, and reported frequently inducing agents to follow malicious instructions in those risk areas. That finding describes the evaluation, not the behavior of every current agent. (NIST CAISI, January 17, 2025)
GitHub’s cloud-agent documentation likewise warns that an agent with access to code and sensitive information could leak it accidentally or in response to malicious user input. Treat an agent’s repository access, tools, and ability to take actions as security permissions—not as incidental product details. (GitHub’s Copilot cloud-agent risk and mitigation documentation)
Check the exact service and configuration your team uses
Do not assume that every AI product, plan, or provider handles prompts in the same way. Before approving a tool, review the terms and settings that apply to the organization’s actual configuration. For each service, find out:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- What prompts, attachments, repository contents, and workspace context are transmitted or accessible?
- Under this plan, is interaction data used for model training or improvement?
- What retention and deletion terms apply, including when a team supplies its own API key?
- Which organization-level controls govern approved tools, user access, and agent permissions?
- Can the organization detect or block secrets committed to repositories, and who receives alerts?
- Can the team test agent workflows involving malicious instructions embedded in untrusted content?
For example, GitHub says interaction-data treatment depends on plan and notes that data from individual subscribers may be used to train and improve models. In a bring-your-own-key setup, GitHub’s responsible-use documentation says prompts and responses are transmitted to the selected provider and may be subject to that provider’s retention and privacy policies. Those statements are specific to the documented GitHub offerings and configurations; check the current Copilot product information and responsible-use documentation for the plan and setup in use rather than applying them to other services.
Best Value
Build controls for prompts, agents, and repositories
No single control covers all three exposure paths. Organizations can reduce risk with a layered program:
- Define approved tools and data classes. Specify which services developers may use and what kinds of company information may be submitted. Give clear examples of prohibited material, including credentials and sensitive customer data.
- Reduce what developers submit. Train developers to remove credentials and unnecessary proprietary context before using an AI tool. Encourage them to provide only the minimum code or information needed for the task.
- Limit agent permissions to the task. Restrict repository and tool access to what the work requires. Avoid giving an agent broad access to sensitive information or actions it does not need.
- Test relevant agent workflows. Include untrusted content with malicious instructions in security tests, and assess whether the agent can access or take actions beyond its intended task.
- Scan repositories and protect pushes. Use secret scanning to detect sensitive values such as API keys and tokens, and push protection to help block secrets before they are committed. Set an alert owner and a process for acting on detections. These controls address repository exposure; they are not prompt filters.
- Review service terms when configurations change. Recheck data handling when the plan, provider, organization settings, or agent capabilities change, since the relevant terms and controls can differ.
NIST’s SP 800-218A, published July 26, 2024, supplements the Secure Software Development Framework with practices for AI model development across the software development lifecycle. NIST says it is intended for producers of AI models, producers of systems that use models, and acquirers of those systems. It is a framework for secure-development responsibilities, not evidence about how often employees submit secrets to chatbots. NIST’s Control Overlays for Securing AI Systems project identifies use cases including adapting and using an LLM assistant, using single- or multi-agent systems, and controls for AI developers. Its page reported that a concept paper was available for comment on August 14, 2025; check the page for current status rather than treating the overlays as final requirements.
What to do if a secret may have been exposed
If a credential was submitted to a service or exposed through an agent, handle it as a potential confidentiality incident. Follow the organization’s incident process to determine what information was involved, contain access, and assess whether the credential needs to be revoked or rotated. Repository scanning alone cannot establish whether a value was also sent in a prompt. NIST’s SP 1800-28 and SP 1800-29 provide general guidance on identifying and protecting data, and on detecting, responding to, and recovering from confidentiality attacks; they are not LLM-specific standards. (NIST SP 1800-28; NIST SP 1800-29)
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
