# Assume Leaked

> Assume Leaked: build as if your confidential data is already outside, in models and accounts you do not control, and make the leak not matter instead of trying to prevent it.

Formulated by Alexandru Ciobanu, CEO of CUBE Enterprise, 2026. First public use: September 2026 (talk), 15 October 2026 (LinkedIn). Canonical page: https://assumeleaked.com/

Contrast: Assume breach says the attacker is already inside. Assume Leaked says your data is already outside.

Prior art: "assume leak" (Clutch Security, 2025) for secrets and non-human identities. Assume Leaked applies the same instinct to all the confidential data people put into AI tools.

## The three rules

1. An official AI that beats the shadow one.
2. Block the crown jewels, not everything.
3. AI goes into onboarding and offboarding.

## Resources

- Seven questions worksheet (PDF): https://assumeleaked.com/assume-leaked-seven-questions.pdf
- Diagram (PNG): https://assumeleaked.com/diagram-assume-leaked.png
- 30-second clip (MP4): https://assumeleaked.com/assume-leaked-30s.mp4
- Press kit: https://assumeleaked.com/press-kit.zip

## Attribution

Assume Leaked, a principle formulated by Alexandru Ciobanu, CEO of CUBE Enterprise, 2026. assumeleaked.com