AI data exposure incidents
Definition
Data exposure incidents involve confidential, personal, proprietary or otherwise sensitive information being unintentionally disclosed, leaked or made accessible as a result of an AI system's operation, misuse, or the practices of parties that deploy or interact with AI systems.
Included
- Confidential material entered into third-party AI systems and retained or used in training
- Outputs from AI systems that inadvertently reveal personal data
- AI-enabled data scraping or aggregation that exposes protected information
- Leaks of training data containing personal, proprietary or sensitive records
- Breaches of AI platforms that expose user conversation histories or query logs
Excluded
- Breaches where AI played no material role in the exposure
- Intentional sharing of data by the subject themselves
- Theoretical risk assessments without a documented event
- Incidents classified primarily under a different category where data exposure was incidental