AI Systems Atlas

S-04Data Exfiltration

/security/data-exfiltration

Secrets that legitimately entered context leave through any outbound channel — URLs, headers, rendered images, commit messages.

Key insight

Exfiltration needs two things: a secret in context and an outbound channel. You rarely control the first; you fully control the second. Enumerate every way bytes leave.

Failure mode

Blocking the obvious channel (email) while markdown image URLs, DNS lookups and log lines remain wide open.

Further reading
RelatedIndirect injectionCredential leakage

Elsewhere in the atlas

Harnesses →Evals →Context →Coding Agents →