Where Prompts, Files, and Outputs Can Travel
Trace the lifecycle from your device through the provider, model, tools, logs, people, and deletion paths.
In this lesson, you will learn to:
- Draw the lifecycle of an AI interaction.
- Identify persistence, access, and reuse questions at each stage.
Where Prompts, Files, and Outputs Can Travel
Explains transmission, history, memory, logging, training, retrieval, subprocessors, output sharing, and the difference between deletion controls and verified erasure.
Follow the whole lifecycle
An AI interaction can pass through the app, provider gateway, model service, safety filters, logging systems, retrieval indexes, connected tools, and subprocessors. It may appear in chat history, administrator records, abuse monitoring, backups, or product-improvement processes. The generated output can then be copied into documents, shared links, code, or another AI system.
Do not reduce this to “trained” or “not trained.” Training use is important, but retention, human access, security logging, account visibility, geographic processing, and deletion also matter. Map each stage: what enters, who can access it, why it is kept, how long it remains, where it goes next, and how you can remove or export it. Product-specific evidence should answer the map.
Instructions and data share the same context
A model often receives trusted instructions and untrusted content together. A document can contain text telling the model to ignore the user, reveal secrets, or call a tool. A webpage, email, image, code repository, or retrieved note can carry similar instructions. This is indirect prompt injection: the attacker’s instruction arrives through data the assistant was asked to process.
The model may not reliably distinguish “content to summarize” from “instructions to follow.” Delimiters and warnings help understanding but are not a complete security boundary. Keep sensitive data away from untrusted retrieved material where possible, restrict tool access, validate actions outside the model, and require approval before the system sends, deletes, purchases, publishes, or changes permissions.
Deletion and opt-out need precise language
A chat-delete button may remove the conversation from your visible history while other copies remain for a stated period or legal purpose. An opt-out may affect future model improvement but not existing training, safety logs, or third-party integrations. Memory can be separate from chat history. Temporary-chat modes may have different retention rather than zero retention.
Read what the control actually promises, test administrative settings, and avoid using deletion as permission to disclose something unsuitable. If you need contractual deletion, audit evidence, regional processing, or no-training commitments, choose a service and plan that provides those terms. Keep your own record of what was shared so you can respond if the provider changes behavior or reports an incident.
Resources
- OWASP LLM Top 10 2026 — Review the current OWASP project overview for prompt injection, sensitive information disclosure, excessive agency, misinformation, and related risks.