In authorized testing, a county clerk bot discloses internal routing hints when asked to repeat its rules. Which risk class does that finding primarily represent?

When a county clerk bot reveals internal routing hints or restates its hidden rules under authorized probing, the primary risk class is sensitive information disclosure—specifically system-prompt or internal-guidance leakage discovered during reconnaissance-style interaction. That leakage exposes instruction hierarchy, escalation paths, tool routing, or policy text an adversary can reuse to craft more effective follow-on injections. Correct classification drives remediation such as prompt isolation, response filtering for meta-instructions, and least-disclosure system design for municipal assistants. Insecure output handling where model-generated routing text triggers unauthorized downstream workflow actions describes a different vulnerability class—unsafe output consumption leading to action—not the read-only disclosure the clerk bot exhibited when it echoed routing hints. Information exposure of a staff directory embedded in training data would be a training-data leakage finding, but nothing here shows the bot regurgitating memorized directory data rather than its own system instructions. Model hallucination fabricating plausible internal procedures confused with actual system instructions describes a different failure mode—generative confabulation rather than genuine disclosure—the finding is about what the bot reveals once prompted, not about whether it invents false procedures. Exam caveat: authorized recon may elicit disclosure, but assessment reports should summarize the class of leakage and impact without dumping full system prompts into broad distribution lists. Operational check: reproduce with sanitized prompts in a test tenant, verify whether production responses still echo system or routing text, and track closure via prompt redaction, output filters, and periodic leakage regression tests for clerk-facing civic bots.