Email Address Detected In AI Usage
Updated: August 11, 2026
Description
An email address was detected in an employee's AI usage.
Email addresses are personally identifiable information (PII). Sharing them with third-party AI services may breach data protection obligations such as GDPR or CCPA, particularly if the service retains conversation history or uses submissions for model training.
Example Attack
An employee pastes a customer support email thread into an AI chatbot to draft a reply. The thread contains the customer's email address, which is retained by the AI provider and potentially used for model training, constituting an unauthorised disclosure of personal data.
Remediation
Review the interactions to determine whose email addresses were shared and with which AI services. Configure guardrails to redact or block PII in prompts, and direct employees towards approved AI services with acceptable data handling terms. Ensure employees understand that personal data must not be shared with unapproved AI services.
Security Frameworks
Sensitive fields must be detected and masked, tokenized, or dropped before embedding, and memory and tool writes treated as untrusted input.
AI interactions, safety filtering and policy decisions, and inference telemetry must be logged to a structured, interoperable schema to support audit and incident response.