2026生成式 AI 数据安全报告：风险与缓解措施

OWASP GenAI Data Security Summary

Core Content

OWASP GenAI Data Security is a document that outlines the data security risks and mitigations specific to Large Language Models (LLMs), Generative AI (GenAI), and Agentic AI applications. It is not a replacement for the OWASP Data Security Top 10 but rather an extension and update of the LLM and GenAI Data Security Best Practices Guide from February 2025. The document is structured to provide a focused lens on the unique data security challenges introduced by GenAI systems and includes a companion implementation guide to improve accessibility and readability.

Main Objectives

• Provide a detailed understanding of data security risks in the context of GenAI.
• Offer mitigation strategies across different security maturity levels (Tier 1, Tier 2, Tier 3).
• Align with OWASP's broader work and support the OWASP Top 10 for LLMs and Agentic AI.
• Emphasize the need for a proactive, minimalistic security posture due to the unique architecture of GenAI systems.

Key Concepts

• Data Security in GenAI: Focuses on protecting the confidentiality, integrity, availability, and authenticity of data across the entire lifecycle, including training, inference, and output.
• AI-DSPM (Data Security Posture Management for GenAI): A continuous practice to discover, classify, govern, and monitor data across GenAI pipelines and runtimes.
• Unique Risks: These include sensitive data leakage, agent identity exposure, shadow AI, data poisoning, and more, due to the new data surfaces and failure modes introduced by GenAI.

Main Risks and Mitigations

The document outlines 21 data security risks (DSGAI01 to DSGAI21), each with a detailed description, attacker capabilities, impact, and mitigation strategies. These risks are organized in a logical flow through the GenAI system lifecycle.

Key Risk Categories

1. Data Leakage
2. Poisoning & Tampering
3. Unauthorized Access
4. Inference & Reconstruction
5. Observability & Telemetry
6. Vector Store & Embedding Risks
7. Data Governance & Compliance
8. Shadow AI & Unsanctioned Data Flows
9. Multimodal & Cross-Channel Leakage
10. Synthetic Data & Anonymization Issues
11. Cross-Context & Multi-User Conversation Bleed
12. Unsafe Data Gateways
13. Data Availability & Resilience Failures

Key Mitigations

The document categorizes mitigations into three tiers based on implementation complexity and security maturity:

Tier 1 (Foundational)

• Policy: "No-train/no-retain" for user uploads.
• Oversharing Reduction: Identify and fix over-broad access in RAG systems.
• Ops Hygiene: Restrict logging and scrub traces.
• Prompt Architecture: Separate system prompts from user context.
• Data Minimization: Redact or tokenize sensitive fields before training.
• Output Controls: Implement PII/secret detectors and monitor high-risk patterns.
• RAG Hardening: Enforce per-document ACLs and basic result filtering.
• Rate-Limiting: Limit repeated queries for sensitive topics.

Tier 2 (Hardening)

• Ops Hygiene: Encrypt data in transit and at rest.
• Detection & Monitoring: Real-time DLP scanning and anomaly detection.
• Extraction & Distillation Defense: Monitor for probing patterns and disrupt extraction attempts.
• Indirect Prompt Injection: Block markdown image rendering to external URLs and sanitize tool callbacks.
• Format-Preserving Encryption (FPE): Maintain data structure without exposing sensitive values.
• RAG Hardening: Implement memory isolation, sanitization, and expiration controls.

Tier 3 (Advanced)

• Testing: Continuous red-team exercises and regression tests.
• Privacy-Preserving Learning: Use differential privacy and federated learning.
• Verifiable Erasure: Design and test protocols for data deletion across all data forms.

Known CVEs / Exploits

• CVE-2024-5184 (EmailGPT): Prompt injection leading to data leakage.
• CVE-2025-54794: Prompt injection hijacking Claude AI.
• CVE-2025-32711: M3 vulnerability.

Summary of OWASP GenAI Data Security

OWASP GenAI Data Security highlights the unique challenges and risks associated with data handling in GenAI systems. It introduces the concept of AI-DSPM, which extends traditional data security practices to address the specific needs of GenAI. The document emphasizes the importance of minimizing data exposure, enforcing strict access controls, and maintaining data integrity throughout the system lifecycle. It also outlines a comprehensive set of mitigations tailored to different organizational security maturity levels, ensuring that organizations can implement appropriate controls based on their current capabilities and goals.

The document is licensed under Creative Commons, CC BY-SA 4.0, allowing free sharing and adaptation with proper attribution.