OWASP GenAI 数据安全风险与缓解措施 2026

Risks and Mitigations 2026 Version1.0March2026 The information provided in this document does not, and is not intended to, constitute legal advice. Allinformation is for general informational purposes only. This document contains links to other third-partywebsites. Such links are only for convenienceand OWASP does not recommend or endorse the contents ofthe third-party sites. License and Usage This document is licensed under Creative Commons, CC BY-SA 4.0 You are free to: ●Share—copy and redistribute the material in any medium or format●Adapt—remix, transform, and build upon the material for any purpose, even commercially.●Under the following terms:○Attribution—You must give appropriate credit, provide a link to the license, and indicate ifchanges were made. You may do so in any reasonable manner but not in any way thatsuggests the licensor endorses you or your use.○Attribution Guidelines-must include the project name as well as the name of the assetReferenced■OWASP Top 10 for LLMs-GenAI Red Teaming Guide●ShareAlike—If you remix, transform, or build upon the material, you must distribute yourcontributions under the same license as the original. Table of Content Document Scope and Objectives5What is Data Security in the GenAI Context?6DSPM for Gen AI (AI-DSPM)9GenAI Data Risks13DSGAI01—Sensitive Data Leakage15DSGAI02—Agent Identity & Credential Exposure20DSGAI03—Shadow AI & Unsanctioned Data Flows24DSGAI04—Data, Model & Artifact Poisoning28DSGAI05—Data Integrity & Validation Failures34DSGAI06—Tool, Plugin & Agent Data Exchange Risks37DSGAI07—Data Governance, Lifecycle & Classification for AISystems42DSGAI08—Non-Compliance & Regulatory Violations46DSGAI09—Multimodal Capture & Cross-Channel Data Leakage50DSGAI10—Synthetic Data, Anonymization & Transformation Pitfalls54DSGAI11—Cross-Context & Multi-User Conversation Bleed59DSGAI12—Unsafe Natural-Language Data Gateways (LLM-to-SQL/Graph)63DSGAI13—Vector Store Platform Data Security67 DSGAI14—Excessive Telemetry & Monitoring Leakage71DSGAI15—Over-Broad Context Windows & Prompt Over-Sharing74DSGAI16—Endpoint & Browser Assistant Overreach78DSGAI17—Data Availability & Resilience Failures in AI Pipelines82DSGAI18—Inference & Data Reconstruction86DSGAI19—Human-in-the-Loop & Labeler Overexposure90DSGAI20—Model Exfiltration & IP Replication93DSGAI21—Disinformation & Integrity Attacks via Data Poisoning96 Acknowledgements101 OWASP GenAI Security Project Sponsors102 Project Supporters103 Document Scope andObjectives The objective and scope of this document is to provide a focused lens on the data security risks andmitigations specific to LLMs, GenAI and Agentic AI Applications.This document is not intended to serve asan OWASP Top 10 guide, nor is it designed to replace the OWASP Data Security Top 10.This is anevolution and update of theLLM and Gen AI Data Security Best Practices Guidepublished in February of2025. It is designed to be aligned with and support the OWASP Top 10 for LLMs and Agentic AI Top 10 withcross-references to related risks and resources. The single “LLM and Gen AI Data Security Best Practices Guide” is being broken into two documents, theenumeration of the risks and mitigations (this document), and a companion document on implementation ofbest practices to improve accessibility and readability while accounting for the rapid revisions in GenAI andAgentic AI related risks. The goal is not to duplicate risks identified elsewhere but to provide a specificlisting for those risks tied directly to LLM, GenAI and Agentic AI applications and workloads. What is Data Security in theGenAI Context? In GenAI,data securityis the set of safeguards that protectsconfidentiality, integrityavailability andauthenticityof data as it is stored, moves through and is transformed by LLM/GenAI/agentic systems—acrosstraining/fine-tuning, retrieval (RAG), tool use, agent memory, telemetry/observability, inference-time processing, and downstream outputs. This matters because GenAI introduces new data surfaces(prompts, context windows, embeddings/vector stores, agent traces, tool payloads) and new failure modes(prompt-driven extraction, cross-session bleed, inference attacks, plugin/tool drains). This document’s intent is to provide afocused lens on data security risks and mitigations specific to LLMs,GenAI, and Agentic AI(not a “Top 10” replacement), aligned to OWASP’s broader work, and paired with acompanion implementation guide. Practically, “data security” in GenAI means protecting: •Source data:raw corpora (structured + unstructured), user uploads, tickets, knowledge bases,analytics exports.•Derived data: embeddings, indexes, retrieved passages, summaries, synthetic datasets, featurestores.•Model artifacts:checkpoints, adapters/LoRA, training logs, evaluation sets, model registries.•Runtime data:prompts, context windows, tool calls (LLM-to-SQL/Graph/API), agent-to-agentmessages, transient caches (e.g., KV cache), session memory.•Operational exhaust:logs, tra