Data exfiltration

Data exfiltration is the unauthorized transfer of data out of a system. In AI applications it usually means an attacker steering a model or agent into sending private context to a destination the attacker controls.

The usual trigger is indirect prompt injection, because a model draws no reliable boundary between its instructions and the content it reads. Hidden text in a retrieved document, web page, or email can therefore redirect whatever data the model can already reach.

Simon Willison named the enabling combination the lethal trifecta in June 2025: private data, untrusted content, and a channel for external communication. That channel is commonly one of these:

  • A tool call or MCP request that posts the data to an attacker-controlled endpoint
  • A Markdown image or link whose URL encodes the data and loads when the client renders the reply
  • The reply text itself, when the attacker can read the transcript

Each leg of the trifecta is also a place to intervene, and the simulation below replays the chain with any one of them switched off.

Interactive diagram — enable JavaScript to view.

EchoLeak (CVE-2025-32711), disclosed against Microsoft 365 Copilot in June 2025, hit all three legs with a Markdown image as the channel: a crafted email carried hidden instructions that packed mailbox and document content into an image URL, which the client fetched automatically as soon as the reply rendered.

Defenses sit outside the model, in least-privilege tool scopes, allowlists for outbound domains, links that don’t auto-render, and telemetry over tool-call sequences. The OWASP LLM Top 10 tracks the outcome as sensitive information disclosure.

A person in overalls pointing at a four-piece puzzle map labeled IDE, Cloud, CLI, and PR/Repo, with a map info legend beside it and a Python logo.

Tutorial

AI Coding Agents Guide: A Map of the Four Workflow Types

AI coding agents come in four types: IDE, terminal, PR, and cloud. Learn how each workflow fits into modern Python development.

intermediate ai

For additional information on related topics, take a look at the following resources:

Have a question about this? Mentor AI can show you examples, compare related terms, and point you to tutorials.

  • Ask Mentor AI
  • Pick a question and Mentor AI takes it from here.
By Martin Breuss • Updated Sept. 28, 2026
AI Coding Glossary Share Feedback