Get Early Access
HomeSecurityData Exfiltration

AI AGENT SECURITY THREAT

How can AI agents exfiltrate sensitive data?

AI agents can access data, call tools, and communicate with external systems. Data exfiltration risk arises when sensitive information moves beyond an approved trust boundary through an unsafe action, compromised workflow, or manipulated agent.

Explore Runtime SecurityExplore Agent Identity & Permissions

THE DEFINITION

Data movement becomes a security decision

AI agent data exfiltration is the unauthorized or unintended movement of sensitive information from a trusted system to an external or unapproved destination through an AI agent, its tools, connected services, or workflows.

  • Exfiltration can be deliberate or accidental
  • Legitimate access does not make every destination safe
  • Prompt injection can influence disclosure or transfer
  • Least privilege limits the data an agent can reach
  • Runtime policy can evaluate movement before it happens

A SIMPLE EXAMPLE

Access to data does not automatically imply permission to move it.

AGENT TASKAnalyze customer churn.
LEGITIMATE ACCESSRead customer records.
UNEXPECTED ACTIONGenerate a customer CSV and upload it to an external service.

ACCESS VS. MOVEMENT

Reading data and moving data are different permissions

Security decisions should consider destination and action, not only source access.

01 · READRetrieve approved data for a task.Read customer account.↓
02 · TRANSFORMSummarize or restructure approved data.Generate internal report.↓
03 · MOVESend or upload information elsewhere.Upload report to external service.↓
04 · EXFILTRATELeave an approved trust boundary without authorization.Sensitive data sent outside.

OUTBOUND PATHS

How data can leave through an AI agent

EXTERNAL MESSAGINGEmail, chat, or another communication tool.
FILE UPLOADA generated or retrieved file sent elsewhere.
API CALLSensitive fields sent to a third-party API.
MCP TOOLAn MCP capability transmits data downstream.
WEB REQUESTInformation submitted to an external site.
CODE EXECUTIONAgent-generated code moves data elsewhere.
CLOUD STORAGESensitive content written to an unapproved location.
AGENT-TO-AGENTContext passed outside the expected boundary.

PROMPT INJECTION + EXFILTRATION

Prompt injection can turn legitimate access into data loss

Prompt injection becomes more dangerous when the manipulated agent can both read sensitive data and communicate externally. The attacker may influence the agent without direct database access.

Untrusted content↓Malicious instruction↓Agent retrieves sensitive data↓External tool selected↓Data leaves boundary
Prompt Injection Indirect Prompt Injection

PERMISSIONS

The agent can only exfiltrate what it can reach

Least privilege limits the information available to a compromised or misbehaving agent.

AGENT APublic documentationExternal messaging · yesPotential data impact · low
AGENT BCustomer records · financial data · internal documentsExternal messaging · yesPotential impact · much higher
Explore Agent Identity & Permissions Overprivileged Agents

TOOL MISUSE

Legitimate tools can become data-loss paths

No tool is necessarily malicious. The risk comes from how capabilities are chained.

Explore Tool Misuse
Agent task · Analyze CRM data↓CRM Search↓Expected · internal analysis↓Unexpected · File Export → External Upload

MCP + DATA MOVEMENT

MCP can create additional routes for data movement

MCP servers may expose tools that query internal data, transform it, send messages, upload files, or call external APIs. Review inbound and outbound access paths together.

Explore MCP Security MCP Attacks
AGENT↓MCP SERVER↓TOOL↓DOWNSTREAM CREDENTIAL↓INTERNAL DATA↓EXTERNAL DESTINATION

DATA CLASSIFICATION

Not every data movement has the same risk

Data sensitivity can inform whether an outbound action is expected, reviewed, or prohibited.

PUBLICDesigned for external distribution.External sharing may be acceptable.
INTERNALIntended for employees or approved systems.External sharing needs context.
CONFIDENTIALSensitive business or customer information.Review before transfer.
RESTRICTEDHighly sensitive data requiring strong controls.Prohibit external transfer.

DESTINATION CONTEXT

The same data can be safe in one destination and unsafe in another

Data security requires understanding where information is going, not only what it contains.

DESTINATION AApproved internal analyticsExpected
DESTINATION BApproved support systemContext-dependent
DESTINATION CUnknown external file hostHigh risk

MULTI-STEP EXFILTRATION

Data exfiltration may emerge from a sequence of legitimate actions

The risk may exist in the workflow, not in a single tool call.

01Query customer databasePotentially legitimate
02Summarize recordsPotentially legitimate
03Generate spreadsheetPotentially legitimate
04Upload spreadsheetPotentially legitimate
05Send link externallySensitive data leaves boundary

DATA MINIMIZATION

Agents should receive only the data they need

TASK REQUIRESAggregate statisticsRaw customer records are unnecessary.
TASK REQUIRESOne accountThe entire tenant is unnecessary.
USEFUL PRINCIPLESNarrow queries · fewer fields · no unnecessary secrets · bounded context

USER-DELEGATED ACCESS

User delegation can expose more data than the task requires

Delegated identity should be scoped to the task. An agent summarizing a calendar should not automatically inherit every resource an executive can reach.

Explore Agent Identity & Permissions
USER · EXECUTIVECustomer records · financial data · strategy documents
AGENT TASK · SUMMARIZE CALENDARNeeded · calendar contextUnnecessary · customer data · finance · strategy

OUTBOUND CAPABILITIES

Every outbound capability creates a potential data path

EmailMessagingFile uploadBrowserAPICloud storageWebhookCode executionMCP toolAnother agent

RUNTIME CONTROL

Evaluate sensitive data movement before it happens

Runtime security can evaluate source, data sensitivity, action, identity, and destination together.

Explore Runtime Security
REQUESTED ACTIONUpload generated reportDATA · Restricted customer informationDESTINATION · External file serviceIDENTITY · research-agentPOLICY · Restricted data cannot be exported externallyBLOCK

HUMAN APPROVAL

Require review for sensitive data transfers

Some data movement may be legitimate but still deserve approval. Not every sensitive action needs to be permanently blocked.

AGENT REQUESTSSend financial report to external recipientDATA · ConfidentialRECIPIENT · ExternalDECISION · REVIEW REQUIRED

RELATED TERMS

Data leakage, data loss, and exfiltration are related but different

DATA LEAKAGESensitive information becomes exposed unintentionally.
DATA LOSSData is lost, destroyed, or becomes unavailable.
DATA EXFILTRATIONData moves outside an approved trust boundary without authorization.

SECRET EXPOSURE

Agents can also expose credentials and secrets

Potentially sensitive values include API keys, access tokens, database credentials, private keys, internal URLs, source-code secrets, and configuration values. Agents should not receive secrets that are unnecessary for their task.

API keysAccess tokensDatabase credentialsPrivate keysInternal URLsSource-code secrets

MEMORY + CONTEXT

Sensitive data can persist beyond the original task

Some systems store conversation history, agent memory, tool responses, or generated artifacts. Security teams should understand what persists, where it is stored, for how long, and who can access it.

Conversation historyAgent memoryTool responsesGenerated artifactsRetention periodAccess scope

AGENT-TO-AGENT MOVEMENT

Multi-agent systems create additional trust boundaries

One agent may retrieve data and pass it to another. Security teams should understand which agents communicate, what context is shared, and whether identities, permissions, environments, or vendors change.

Research Agent→Finance Agent→External Analysis Agent

DEFENSE IN DEPTH

How to reduce AI agent data exfiltration risk

01APPLY LEAST PRIVILEGELimit which data agents can access.
02MINIMIZE DATARetrieve only the information needed.
03LIMIT OUTBOUND TOOLSRestrict channels that transmit data.
04CLASSIFY SENSITIVE DATAUse sensitivity in authorization decisions.
05CONTROL DESTINATIONSDistinguish approved from external systems.
06VALIDATE TOOL ACTIONSEvaluate parameters and operations.
07APPLY RUNTIME POLICYReview sensitive movement before execution.
08REQUIRE HUMAN APPROVALUse review for high-impact transfers.
09SEGMENT TRUST BOUNDARIESSeparate sensitive and external systems.
10MAINTAIN AUDITABILITYRecord what moved, where, and why.
11RED TEAM DATA PATHSTest whether tools combine into exfiltration.

RED TEAMING

Test whether agents can move data beyond intended boundaries

Test manipulated content, external upload tools, tool chains, MCP paths, delegated access, sensitive destinations, and low-risk actions that combine into an unsafe transfer.

Explore AI Red Teaming
What data was accessed?Which identity enabled it?Which tools moved it?Where was it sent?Did policy intervene?Did approval work?

AUDITABILITY

Trace sensitive data from source to destination

Security teams should be able to connect the agent, identity, source, tool, destination, policy, approval, and outcome. The event trail below is illustrative.

14:13:20Customer data queryALLOW
14:13:28Generate exportREVIEW
14:13:35External uploadBLOCK

SECURITY GUIDANCE

AI data leakage and exfiltration in security guidance

OWASP generative AI and agentic security guidance, MITRE ATLAS, NIST AI security guidance, and recognized data-security practices provide useful language for threat modeling. Eyrane connects those principles to data, tools, identities, destinations, and actions.

AI Agent Security guide Agentic Security guide MCP Security guide

COMMON QUESTIONS

Questions security teams ask about AI agent data exfiltration

What is AI agent data exfiltration?

AI agent data exfiltration is the unauthorized or unintended movement of sensitive information from a trusted system to an external or unapproved destination through an agent, tool, connection, or workflow.

How can an AI agent leak sensitive data?

An agent can leak data by sending messages, uploading files, calling external APIs, writing to cloud storage, or passing context to another agent outside the approved trust boundary.

Can prompt injection cause data exfiltration?

Yes. Prompt injection can influence an agent with legitimate data access to retrieve sensitive information and choose an outbound tool. Least privilege and runtime policy can reduce the impact.

How do AI tools create data-loss risk?

A legitimate tool can become a data-loss path when an agent chains a read action with an export, upload, message, or external API call.

Can MCP tools expose sensitive data?

Yes. MCP tools may query internal data or transmit it through downstream credentials, so security teams should understand both the tool and its reachable destinations.

What is the difference between data leakage and data exfiltration?

Data leakage is unintended exposure, data loss is destruction or unavailability, and data exfiltration is unauthorized movement outside an approved trust boundary.

Why does least privilege reduce data exfiltration risk?

Least privilege limits the data, tools, identities, and destinations an agent can reach if it behaves unexpectedly or is manipulated.

How can organizations control AI agent data movement?

Organizations can minimize data, restrict outbound tools and destinations, classify sensitive information, apply runtime policy, require approval, and maintain an audit trail.

Should sensitive AI agent actions require human approval?

Some sensitive transfers should require approval when the action, data, destination, or identity creates meaningful impact.

How does runtime security reduce data exfiltration risk?

Runtime security evaluates context such as identity, data sensitivity, action, and destination before a transfer executes, allowing, reviewing, or blocking it as appropriate.

Can multi-step agent workflows create data exfiltration?

Yes. A sequence of individually reasonable reads, transformations, uploads, and messages can combine into an unsafe data movement path.

How can organizations test AI agents for data exfiltration?

Red teams can test prompt injection, tool chaining, MCP paths, delegated access, external destinations, and approval controls to see whether sensitive data can leave its intended boundary.

RELATED CONTENT

Prompt InjectionIndirect Prompt InjectionExcessive AgencyOverprivileged AgentsTool MisuseMCP AttacksAgent Identity & PermissionsRuntime SecurityMCP SecurityAI Red Teaming

AI AGENT DATA EXFILTRATION

Keep sensitive data inside the boundaries you define.

Limit what agents can access, control where they can send it, and evaluate sensitive data movement before it happens.

Explore Runtime SecurityGet Early Access