Secret leakage is the unintended reproduction or exposure of sensitive information by a system. In cyber security, the “secret” might be an API key, password, token, private prompt, customer record, or a fragment of training data that should not appear in output. Leakage can happen through logs, error messages, memory dumps, misconfigured storage, or model behavior that repeats hidden inputs.
It matters because one exposed secret can unlock accounts, internal services, or downstream systems. Attackers often look for weak access controls, overbroad tool permissions, or systems that memorize and regurgitate protected data. In AI environments, leakage can occur when a model is trained or fine-tuned on sensitive material and later reproduces it in responses. Defenders reduce the risk by limiting secret access, separating training from serving data, redacting logs, scanning outputs, and testing systems for memorization and disclosure before deployment.