When a wooden horse was wheeled through the gates of Troy, it was welcomed as a gift but hid a dangerous threat. Today, organizations face the modern equivalent: the Trojan prompt.

It might look like a harmless request: “summarize the attached financial report and point out any potential compliance issues.” Within seconds, a generative AI tool delivers a neatly packaged analysis that saves hours of work. What feels like productivity, however, is actually exposure: by pasting a sensitive document into a public AI model, an employee has unknowingly smuggled confidential data beyond the organization’s walls.

This isn’t the work of malicious insiders, but of well-intentioned staff simply trying to work faster and smarter. Yet the scale is staggering – nearly 1 in 20 enterprise users now rely on GenAI, with sensitive data flowing into these platforms 30 times more year-on-year. Worse still, 72% of this shadow AI use happens outside IT’s control, leaving organizations blind to the modern equivalent of opening Troy’s gates.

The Hidden Warriors Inside the Trojan Prompt

There are even greater dangers than copying and pasting data into GenAI tools. Risks including prompt injection attacks – where hidden commands are embedded in documents or queries that can co-opt systems into ignoring security protocols or sharing confidential information. Other hidden soldiers inside the horse include: context hijacking, data poisoning, and LLM memory persistence, where cached queries or context reuse could expose sensitive information to subsequent users.

Importantly, there are real-world exploits. Security researchers from University of California, San Diego (UCSD) and Nanyang Technological University in Singapore unveiled a new attack that covertly instructs an LLM to harvest sensitive information. This includes names, ID numbers, payment details, email and postal addresses, which can be sent directly to a hacker. Dubbed “Imprompter”, the attack relies on an algorithm that turns a user’s prompt into hidden malicious commands, achieving close to an 80% success rate in extracting personal data through obfuscated prompts.

Keys Left at the Gate

These risks grow exponentially when employees accidentally feed sensitive data – including API keys, login details, or confidential documents – into GenAI platforms. Leaving credentials such as these exposed is like a company opening its own gates. If that information is stored or intercepted, attackers can use it to pose as legitimate users and slip into corporate systems unnoticed. Traditional security tools often miss this kind of activity because the access looks genuine, and the data typically moves through encrypted channels.

Why the Old Walls Don’t Hold

Tools like Data Loss Prevention (DLP) and User and Entity Behaviour Analytics (UEBA) are important layers in a security strategy. They track activity across networks and applications, flagging risks like bulk data transfers or unusual file access. These defenses can also alert staff when they attempt to upload sensitive files to unsanctioned cloud services or external GenAI platforms. Like Troy’s towering walls, perimeter defenses may look strong, but they have blind spots as they cannot see what the horse conceals. Most depend on visibility into corporate networks or approved apps, but as soon as employees feed documents into public GenAI tools, those actions often escape monitoring, especially when traffic is encrypted or routed through personal accounts.

Consider an employee who, trying to save time, pastes login credentials or confidential files into a public GenAI tool. Those details may be retained in the model or intercepted by attackers exploiting platform flaws. With valid credentials in hand, hackers can slip into corporate systems and quietly siphon off sensitive data. Traditional tools often miss this – once an attacker has valid credentials, they can blend in with legitimate activity, sidestepping network-level protections altogether.

The missing layer is stronger protection where the data resides: in the memory of the endpoint.

Looking Inside the Horse

Encryption is essential for safeguarding data in transit or at rest, and good key management helps block unauthorized users. But once access is granted, encryption offers little defense because it’s ultimately designed to stop outsiders, not insiders or compromised accounts. This is where dynamic, hardware level zero trust goes further, by providing:

1. Continuous validation of every access attempt at the chipset or SSD layer
2. Anomaly detection to spot unusual reads/writes, bulk transfers, or mass deletions
3. Autonomous lockdowns that halt suspicious activity before data leaves the device

By spotting abnormal access at the physical layer, it blocks malicious transfers automatically, regardless of user credentials or network visibility. Think of it like this: instead of guarding the city gates, this approach inspects the horse itself – revealing the danger before it can be unleashed. Even if attackers gain access, the system stops the data from ever leaving the device.

Fortify Walls with a GenAI-Aware Insider Threat Strategy

To mitigate threats, organizations need to adopt a multilayered strategy that extends well beyond traditional network security.

Governance and AI-ready policy is the first line of defense. Companies must clearly define which GenAI tools are approved for use, specify what categories of data can be shared, and require employees to confirm they understand and will follow these rules. Clear governance sets the boundaries that prevent accidental or careless exposure.

Education and culture are equally important. Many employees are unaware of the risks involved in pasting sensitive information into GenAI systems. Providing them with AI literacy, practical examples, and simple guidelines helps ensure staff view AI as a safe productivity aid rather than a hidden security trap.

Finally, hardware-level endpoint security delivers the last safeguard. Drives equipped with embedded zero-trust capabilities can autonomously monitor data access at the physical layer, detecting and blocking suspicious transfers before sensitive information leaves the device. This ensures that even if network defenses fail or credentials are compromised, the data itself remains protected.

Innovation Without the Trojan Trap

The answer is not to ban GenAI, but to make it safe to further power innovation. Addressing risks like LLM persistence, cached context reuse, and the limits of encryption requires a combination of governance, training, monitoring, and hardware-based zero trust.  

A practical playbook involves approving a trusted set of GenAI services, configuring DLP and behavioral tools to monitor for abnormal data exports, enforcing hardware-secured storage across all endpoints, and training employees on what information should never be shared with AI tools – and why.

Ultimately, security must follow the data down to the drive itself, because that’s where the line between productivity and exposure is truly drawn. GenAI can be a welcome gift – but only if any hidden saboteurs are stripped from the horse.