AI Systems Atlas

S-04Data Exfiltration

/security/data-exfiltration

Secrets that legitimately entered context leave through any outbound channel — URLs, headers, rendered images, commit messages.

Step-by-step walkthrough2 variants · 6 steps

Attack

  1. Secrets sit in context — they had a legitimate reason to be there.
  2. Any outbound channel can smuggle them: URL params, headers, even markdown image links.
  3. One innocuous-looking request later, the token is gone.

Defended

  1. Secrets are tagged at the source — taint travels with the value.
  2. Outbound requests are inspected: does the payload carry taint? Is the host known?
  3. Unknown hosts are unreachable; tainted payloads to anywhere raise an alarm.
Key insight

Exfiltration needs two things: a secret in context and an outbound channel. You rarely control the first; you fully control the second. Enumerate every way bytes leave.

Failure mode

Blocking the obvious channel (email) while markdown image URLs, DNS lookups and log lines remain wide open.

Further reading
RelatedIndirect injectionCredential leakage

Elsewhere in the atlas

Harnesses →Evals →Context →Coding Agents →Tools →Ops →