Data exfiltration (via agent)
Also called: agent data leak
Using an agent's own tools and access to move sensitive data to somewhere the attacker can read it.
Once an attacker can steer an agent that also has access to something valuable, the last step is getting the data out. Common channels: rendering a markdown image whose URL contains the stolen data (the client fetches it), posting a comment or commit, sending an email, calling an outbound webhook, or writing to a shared resource. Often the data is encoded or summarized to fit.
Why it matters
Exfiltration is the "impact" half of most agent incidents — the injection is only interesting because it leads here. Cutting outbound channels (no auto-fetching of model-supplied URLs, egress allowlists, approval on outbound tools) is often the most practical mitigation when you cannot fully control the untrusted input.
Real-world context
Repeatedly demonstrated 2024–2025 — via markdown image links whose URL carries the data, outbound API calls, issue comments, and email tools driven by injected instructions. Trail of Bits and Invariant Labs both published working chains.
Exposure map
Live counts of instances showing this pattern will appear here once the exposure map is collecting data.