A model can leak data present in its context

Anything placed in the context window can come back out.

If a system puts one customer's record into the prompt to answer a question, that record is available to the model for the rest of that exchange, and models can be talked into repeating things. This is the mechanism behind a whole class of incidents where users see somebody else's data: nothing was breached, the data was simply handed to a system that then said it out loud.