T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- references/incident-response.md:8
- Finding
- Unrestricted Access Guidance for Raw Prompts and Internal Telemetry## Vulnerability Details **File Location**: `references/incident-response.md:8-11, 19-20`; `references/remediation-playbooks.md:33, 74, 95-98` **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: Medium **Vulnerable Code Snippets**: `references/incident-response.md:8-11` ```text ### Immediate (0–1 hour) 1. Identify the user, tool, timestamp, and nature of data entered 2. Pull raw prompt from webhook_events or DLP logs if available 3. Determine data classification: Restricted / Confidential / Internal / Public ``` `references/incident-response.md:19-20` ```text 10. Assess blast radius: was this a one-time entry or pattern of behavior? 11. Check webhook_events for similar events from same user or data type ``` `references/remediation-playbooks.md:33` ```text 1. Pull the specific event(s) from webhook_events — identify user, tool, timestamp, and what credential was entered ``` `references/remediation-playbooks.md:74` ```text 1. Pull list of active AI users from webhook_events who lack training_completions records ``` `references/remediation-playbooks.md:94-98` ```text 2. Run a discovery process: - Query webhook_events for all unique genai_app_name values - Survey department heads for AI tools in use - Check SaaS spend/procurement records for AI vendor payments - Review browser extension data for AI site categories ``` ### Technical Analysis The playbooks instruct an operator or tool-enabled agent to retrieve raw prompts, DLP records, employee activity, training records, procurement records, and browser-extension telemetry. These sources may contain credentials, personal information, MNPI, confidential business content, and detailed records of employee behavior. The instructions do not require the agent to verify the requester's authorization, use a narrowly scoped service account, retrieve metadata before content, redact sensitive values, ...[truncated 1547 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit authorization before querying any internal telemetry source. 2. Document approved roles for access to prompts, DLP events, employee records, procurement data, and browser telemetry. 3. Use dedicated read-only service accounts with row-, tenant-, and time-range restrictions. 4. Retrieve event metadata first; allow raw prompt retrieval only when strictly necessary and separately approved. 5. Redact credentials, tokens, personal data, MNPI, and confidential content before records enter the model context. 6. Prohibit reproducing raw prompts or secret values in generated reports. 7. Add purpose limitation, retention periods, audit logging, and secure deletion requirements. 8. Require legal or privacy review where employee monitoring or personal-data processing is involved. 9. Replace broad discovery instructions with explicitly approved data sources and bounded queries.