What actually gets sent to an AI provider when you ask?

When you ask an AI model a question, the provider receives the whole request, not only the sentence you typed: hidden instructions, the earlier conversation, any attached files or retrieved passages, and descriptions of the tools the model may use. The model has no memory between requests, so everything it needs to know must be sent again each time.

That second point surprises people. It is the key to understanding what leaves your device.

Models are stateless

A large language model, as served over an API, does not remember your last message. Each request stands alone. The appearance of memory in a chat comes from the application, which resends the conversation so far along with your new message.

So by the tenth message in a long chat, the request contains messages one to nine as well. If you pasted a long document in message two, that document is sent again with every later message in that conversation, unless the application trims or summarises the history. Some providers offer caching so that repeated content is cheaper and faster to process, but the content is still part of the request.

The parts of a typical request

Part	What it is	Who wrote it
System prompt	Standing instructions: role, rules, tone, format	The application
Conversation history	Earlier messages and replies	You and the model
Your new message	The question you just typed	You
Attachments	Files, images, pasted text	You
Retrieved context	Passages the application looked up for this question	The application
Tool definitions	Names and descriptions of tools the model may call	The application
Tool results	Output from tools called earlier in the task	Your systems
Parameters	Model name, length limits and similar settings	The application

Alongside the content, the request carries the usual network details: an API key or session token that identifies the account, your IP address, and headers naming the client software.

Retrieved context: the part you do not see

Many AI tools search your documents before asking the model. This pattern is called retrieval-augmented generation. The application finds passages that look relevant and places them in the request, so that the model can answer from them.

This is useful, and it is also the easiest place for more to leave your device than you expected. You typed one line. The application may have added several pages from your files. A well-designed tool shows you what it attached. The guide on AI answers with sources explains why this pattern is worth the trade.

Agents send more than chats

An AI agent works in a loop. It asks the model what to do next, runs a tool, sends the result back, and repeats. Each tool result becomes part of the next request.

For a coding agent, that means file contents, directory listings, command output, error messages and test logs all go to the provider as the task proceeds. If a command prints an environment variable that holds a password, that password is now in a prompt. If the agent reads a configuration file with credentials in it, the same applies.

This is why the set of tools and files an agent can reach matters so much. The guide on skills, plugins and tool servers covers how those are granted.

What is usually not sent

Files the application never read. A model cannot browse your disk. It sees only what the application places in a request. The risk lies in how much the application is allowed to read, not in the model reaching out.
Your password for the provider. A request carries a token or key, not the password itself.
Other applications' data. Unless a tool or integration has been connected that fetches it.

Treat these as the normal case, not a guarantee. What a particular application reads and uploads in the background, such as indexing, telemetry and crash reports, is a question for that vendor.

What happens at the other end

Once a request arrives, the provider processes it and returns a response. What happens afterwards depends on the provider, the plan and your settings. The points that commonly vary are:

how long prompts and outputs are retained, and in which logs
whether content may be used to train or improve models, and whether that is opt-in or opt-out
whether staff or automated systems may review content, for example for abuse monitoring
where the data is processed geographically
which other companies process it on the provider's behalf

Consumer plans and business or API plans from the same provider often have different terms. Do not rely on a summary written by someone else, including this one. Check the provider's current terms for the exact plan you use.

There may also be an intermediary. If you use an AI feature inside another product, the request may pass through that product's servers before reaching the model provider. That adds a custodian. The guide on data custody in AI explains why each hop matters.

How to keep requests small

Start new conversations for new topics. Old history stops being resent.
Paste the relevant section, not the whole document.
Remove what the model does not need. Names, account numbers and identifiers can often be replaced with placeholders without harming the answer.
Keep secrets out of files and output an agent can read. Use a proper secret store. See where your AI keys and logins should live.
Limit what agents can reach. Give each one the folders and tools the job needs, no more.
Prefer tools that show you the request. If you can see what was attached, you can correct it.

None of this requires avoiding hosted models. It requires knowing that the unit of disclosure is the full request, and shaping that request with care.

This is general information, not legal advice. If you handle personal or regulated data, check your obligations with your own adviser.

Where Prism fits

In Prism Desktop, each agent signs in with the owner's own AI account, and Prism never holds that login. Keys stay in the computer's keychain, and only the prompt goes to the AI provider the person chose. Each agent gets only the skills, plugins and tool servers you choose. More detail is on the security page.