data breach
in English: data leak
Data leakage occurs when confidential or personal data reaches someone who should not see it, either accidentally or due to an attack.
In plain terms
Imagine leaving your apartment key under the doormat or forgetting your diary on the tram. No one broke into your place, yet someone can still access what belongs only to you. A data breach is the same in the digital world: passwords, customer lists, medical records, or business plans end up where they should have been secure.
The cause of a leak is often not a movie-style hacker attack but carelessness: an email sent to the wrong address, cloud storage left open, a lost laptop. The AI era has added a new channel: many people paste contracts, customer data or source code into a chatbot without thinking, and the data leaves the company's walls.
AI agents raise the stakes further because they do not just converse; they access your emails, files, and corporate systems. If an agent is deceived or granted overly broad permissions, it can independently forward data you never intended to release.
How it works
- Sensitive data exists somewhere: in a database, an email thread, a shared folder, or text entered into an AI tool.
- A gap opens: human error (wrong recipient, weak password), misconfiguration (storage set to public), a software bug, or a deliberate attack.
- Data escapes: someone downloads or copies it, or an AI agent sends it out under the influence of a hidden, malicious instruction.
- Leakages are often discovered only weeks or months later, for example when the data surfaces on the internet or is misused.
- The affected organization must then assess the damage and close the vulnerability. In the EU, personal data incidents must be reported to the data protection authority without undue delay, preferably within 72 hours of becoming aware of them, unless the incident is unlikely to pose a risk to individuals. In cases of high risk, the individuals themselves must also be notified.
An everyday example
You receive an email from your favorite online store stating that due to a "security incident" you should change your password because your name, address, and email address may have reached unauthorized parties. Or a colleague copies the entire customer list into a free AI chatbot to have it write a summary – and with that, the data has already left the company.
Who is affected
A common misconception
Limits and risks
- Once leaked, data cannot be recalled: you can change a password, but not your date of birth or medical records.
- You do not always know where text entered into an AI tool is stored, who can see it, or whether it is used to train the model – always check the provider's terms.
- AI agents can be induced to release data via hidden instructions (such as text embedded in a website or email), and there is currently no perfect protection against this.
- Leakage often remains unnoticed for a long time, so the fact that you did not receive a notification does not mean your data is safe.
Similar, but not the same
- data theft – In data theft, someone intentionally and unlawfully obtains the data, whereas data leakage can happen by accidental error without an attacker.
- data breach – This is the legal definition under GDPR. It is narrower because it applies only to personal data, but broader because it covers not only data leakage but also data loss, destruction, and unauthorized modification.
- prompt injection – Prompt injection is an attack method that deceives the AI; data leakage is one possible consequence, not the method itself.
Related concepts
information security, cybersecurity, data protection
prompt leakage, training data leak, credential leakage
data breach, prompt injection, data theft, GDPR, shadow AI, access control
A brief history
Data leakage is a problem as old as computer data storage, but the public has paid particular attention to it since the major customer data scandals of the 2000s. In the EU, the GDPR, applicable from 2018, made it generally mandatory to report incidents involving personal data. Generative AI brought a new wave from 2023 onwards, when several large corporations restricted the workplace use of chatbots after employees copied confidential materials into them.
Where things stand
As of late 2026, data leakage is an everyday risk, and AI tools, especially agents with access to email and files, are a new and fast-growing source of it. Companies are increasingly introducing AI usage policies and filtering tools, but there is still no unified, reliable protection.
In the news
- JPMorgan, Amazon and Bank of America restrict external AI agents' accessNov 2, 2026 · Money
- EU backs GDPR change letting AI use personal data without consentOct 19, 2026 · Jog
- Unpatched server behind Victoria student data breachOct 7, 2026 · Education & Family
- DeepSeek to raise at least $12 billion with Tencent backing as Beijing probes data leakageOct 5, 2026 · Agent Age
- Clinicians cause "well-meaning" data leakage by using AI toolsSep 29, 2026 · Health
- Hungarian lawyer warns what data not to enter into AI chatbotsSep 28, 2026 · Jog
- Spanish data protection authority receives first data breach report linked to an AI agentSep 15, 2026 · Jog
- Verizon: source code is the most common data type leaked through generative AI toolsSep 7, 2026 · Code
Also known as
data breach · data leak · data leak · data leakage · data breach · data exfiltration · data leak
This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.