Only part of a reconstructed customer record reproduces reliably - what do you claim in the finding?

## The position you are in Somebody filed a finding against an unattended ticket-triage workflow. The attachment is four hundred captured auto-replies and a reconstructed passage said to be another customer's ticket: a name, an order number, two dates, an internal resolution note. Some spans reproduced identically across independent runs; some varied; twelve were checked against a real record and matched. You have to say what the organisation is asserting. This is a judgment call, not a technical one, and it has four parts that people tend to collapse into one. ## Part one: separate the mechanism from the artefact The mechanism claim is that hidden third-party context pasted into every run is recoverable in slices across many independent, individually unremarkable requests, and that a per-reply length cap and a per-response screening layer bound the fragment rather than the total because neither is stateful across runs. Twelve confirmed spans establish that. The claim does not get stronger with a nicer transcript. The artefact claim is that the reconstructed passage is that customer's record. It is an inference: joins were made on approximate overlaps between paraphrased fragments, coverage gaps are invisible, and stable-but-unconfirmed spans are exactly the format-shaped ones a model converges on unaided. Signing that claim means asserting specific personal data about a named individual on the strength of a merge. Under-claiming here costs you almost nothing, because the mechanism is what any remediation decision turns on. Over-claiming costs a great deal. ## Part two: the cost of being wrong points one way If you assert that a named customer's record leaked and the unconfirmed half was confabulated, you may have started a notification process about invented data, alarmed a real person, and spent the credibility the security function needs for the next finding. If you assert only the confirmed subset and the full record did in fact leak, the mechanism claim already forces the same response. The asymmetry is stark and it should drive the wording. ## Part three: the verification you would need has its own price Confirming the remaining spans means pulling the real ticket and reading another customer's record - an access decision with its own authorisation question, made by someone in security to prove that someone else could read it. Some organisations will approve that under a defined process; some will not; either way it is not a step a triager takes unilaterally because it would tidy up a finding. Deciding whether to seek it, and being able to justify stopping without it, is part of the call. ## Part four: handling of the artefact itself A reconstruction that may contain real third-party data is itself third-party data. Attaching it in full to a ticket readable by an engineering org copies the exposure into a system with wider access than the workflow ever had. Referencing it, restricting it, or reducing it to the confirmed spans are all defensible; pasting the whole transcript into the tracker because it is the evidence is not, and it is a common reflex worth naming. ## Filing it under the right item This often lands under the system-prompt leakage item because the phrase hidden context is in the report. That is the wrong item. The recovered text is another party's data that entered the prompt passively as a worked example - it is not the application's own instructions - so it belongs under sensitive information disclosure. The distinction matters beyond bookkeeping: it changes whose data is at issue, which obligations attach, and which team recognises the finding as theirs. ## What reproducibility means for severity One successful campaign proves the construction worked against one deployment on the days it ran. If the pasted examples rotate, later campaigns may recover confetti instead of a passage, so the demonstrated result may not generalise across time - and a stable result may equally mean nobody has touched that prompt in a year. Say which of those you established and which you assumed. Severity should be argued on the reachability of third-party context across runs, not on the length of any individual reply, because that per-response framing is precisely the reasoning the finding refutes. ## What an interviewer is listening for A candidate who signs the mechanism, quantifies the evidence, refuses to promote stable into confirmed, treats verification as an access decision with a cost, and thinks about where the reconstructed text is allowed to live. A candidate who says file the whole transcript, it is what we recovered has not noticed that the deliverable is itself a copy of the thing that leaked.