How IT Professionals Risk Leaking Confidential Data When Using ChatGPT and Other LLMs
Artificial intelligence has fundamentally changed how IT professionals work. Network engineers, security specialists, system administrators, DevOps engineers and SOC analysts now routinely rely on ChatGPT, Claude and Gemini to parse configuration files, locate errors, explain unexpected behavior and draft scripts.
The time savings are substantial, yet a critical question is often overlooked: exactly what data is being sent to these cloud-based services?
The human factor behind data exposure
The issue is not limited to junior staff. Both experienced engineers and newcomers face the same pressure to resolve problems quickly. In almost every security incident, the root cause is the desire to bypass repetitive manual work rather than any sophisticated attacker technique.
When an engineer pastes a multi-thousand-line log into an LLM with the request to “find anomalies and successful logins,” internal IP addresses, server names, domain information, employee email addresses and authentication tokens travel to the provider’s infrastructure.
Network configuration files present even greater risk
The same pattern occurs with device configurations. Engineers commonly upload running-config files from Cisco, FortiGate and Palo Alto devices to accelerate troubleshooting of ACLs or routing issues. Although passwords may be hashed, the files still disclose:
- Internal and external IP addressing schemes
- VLAN and DMZ topology
- VPN peer addresses and encryption parameters
- Hostnames, interface descriptions and branch names
- SNMP community strings and LDAP server locations
For government agencies, banks and healthcare providers, this information constitutes a direct reconnaissance vector.
Storage and access guarantees remain uncertain
Many users treat conversations with large language models as private notes. In reality, no provider offers absolute assurances regarding long-term storage, internal access by employees or subsequent use of the data. On 28 July 2026 the Malwarebytes research team published an analysis of real incidents triggered by the platform’s “Share” feature, confirming that sensitive corporate data had left organizational boundaries.
Related articles
Zero Trust for AI Agents: Why Separate Identity Alone Is Not Enough
Denis Korbakov, CTO of Smart-Soft, explains why traditional IAM approaches fail to secure autonomous AI agents that dynamically select tools, change context, and delegate authority. Only 21.9% of teams treat agents as distinct identity-bearing entities, while 45.6% rely on shared API keys and 44.4% use generic tokens. Research from Gravitee, Cloud Security Alliance, and Aembit shows that 68% of organizations cannot distinguish AI agent actions from human actions, 74% grant excessive privileges, and 52% allow rights inheritance. The article maps NIST SP 800-207 Zero Trust principles—explicit verification, least privilege, and assume breach—to agent workloads using short-lived scoped tokens, SPIFFE/SPIRE credentials, and layered policy enforcement points. A concrete ticket-diagnosis scenario illustrates how prompt injection can be contained through per-task authorization, dedicated network segments, and independent telemetry from NGFW and SIEM. The piece concludes with an open question on sub-agent delegation chains and offers reference OPA/Rego policies plus runbooks for pilot implementations.
AWS Details Architecture to Reduce Prompt Injection Risks in AI Agents
AWS has introduced a new architecture designed to prevent compromised or manipulated AI agents from accessing data beyond user permissions. The approach relies on Amazon Bedrock AgentCore to shift authorization decisions from the agent itself to the underlying infrastructure and connected services. The core risk arises when agents receive broad credentials to query databases, repositories, and SaaS platforms, allowing potential prompt injection attacks to retrieve unauthorized information. In the proposed design, users authenticate via Amazon Cognito and receive JWT tokens containing attributes such as department or role. The AgentCore Runtime validates these tokens before executing any agent actions, rejecting requests that violate configured rules. For DynamoDB queries, temporary credentials are issued through AssumeRoleWithWebIdentity, with IAM policies enforcing strict access to authorized data partitions only.
Cybercriminals Weaponize OpenClaw AI Agent in ClawHavoc Campaign to Distribute Infostealers
Threat actors have repurposed the OpenClaw AI agent to deliver infostealers by uploading hundreds of malicious skills to ClawHub. The campaign, named ClawHavoc, tricks users into executing encoded commands or installing required tools under the guise of helpful AI recommendations. Researchers at Trellix identified 341 malicious skills, with 335 targeting installation of Atomic macOS Stealer on macOS systems. On Windows, victims receive password-protected archives and fake verification utilities that mirror classic ClickFix tactics. Analysis of repository history uncovered 1,184 suspicious packages linked to 12 authors, enabling theft of passwords, browser data, crypto wallets, API keys, SSH keys, and source code. Users are advised to update OpenClaw, audit installed skills, remove suspicious packages, and rotate potentially compromised credentials while running the agent in a restricted environment.
Server Log Analysis Reveals How Major AI Crawlers Actually Behave on Websites
A detailed examination of server access logs shows that AI vendors operate multiple distinct bots with separate purposes rather than a single crawler. GPTBot performs scheduled training data collection while OAI-SearchBot builds search indexes and ChatGPT-User fetches pages in direct response to user queries. The same pattern appears with PerplexityBot and Perplexity-User at Perplexity as well as ClaudeBot and user agents at Anthropic. Blocking all AI-related user agents in robots.txt therefore prevents both training crawls and live user-driven visits. Analysis of 515 million AI bot events found only 408 requests for llms.txt, confirming the file sees negligible adoption. Verification of IP addresses against vendor-published ranges remains the reliable method for distinguishing genuine bots from spoofed traffic. Effective practices focus on clean HTML structure, fast response times, and selective robots.txt rules that allow user-agent traffic while restricting training crawlers.