Critical SeverityData ExposureFebruary 8, 2024

AI Assistant Leaks Customer PII in Support Responses

A support AI agent inadvertently included personally identifiable information from other customers in response messages due to context window contamination.

System Type:Support Chatbot

What Happened

A customer support AI was deployed with access to customer records to provide personalized assistance. The system used a shared context window that retained information across different customer sessions. When Customer A asked about their account, the AI's response included details from Customer B's previous inquiry, including name, email, and partial payment information. The issue affected over 1,200 customer interactions before it was discovered through a customer complaint.

Root Cause

Improper session isolation in the AI's context management. Customer data was persisted in the model's working memory across session boundaries. No output filtering was applied to detect and redact PII from responses.

Impact

1,200+ customers affected. Regulatory notification required under GDPR and CCPA. Customer trust significantly damaged. Legal review of potential liability. Emergency system shutdown and redesign required.

Lessons Learned

  • 1AI systems handling PII require strict session isolation
  • 2Output filtering for sensitive data is essential, not optional
  • 3Context window management must be treated as a security boundary
  • 4Customer data access should follow principle of least privilege

Preventive Measures

  • Implement strict session isolation with context clearing between customers
  • Add PII detection and redaction to all AI outputs before delivery
  • Limit AI access to only the current customer's data
  • Monitor for cross-session data leakage patterns

How Runplane Would Handle This

Runplane could add a governance layer between the AI and the data retrieval system. Before the AI accesses any customer record, Runplane would verify that the requested data belongs to the customer currently being served. Any attempt to access or include data from other customers would be blocked. Additionally, output policies could scan responses for PII patterns before they reach customers.