Data exfiltration

Four channels account for most of it, and they are worth separating because they fail differently. The first is the prompt itself, which is exfiltration with no attacker involved: a payload containing a customer record or a live credential is sent to a provider that retains it, trains on it, or simply sits outside the jurisdiction the data was supposed to stay in. The failure is one of routing and hygiene rather than intrusion, and the controls are correspondingly boring — redact before egress, and check the data policy of the destination before the request leaves, including the fallback destinations, because a failover that silently sends to a provider the primary was chosen to avoid defeats the entire arrangement.

The second is rendered output, and it is the one that surprises people. Markdown is the lingua franca of chat interfaces, and an image in markdown is fetched by the client automatically when the message renders. So a model persuaded to emit an image whose URL carries data in a query parameter has exfiltrated it with no click, no download and no user action: the victim’s own browser or client makes the request to the attacker’s server, carrying the payload in the path or the query string. The same works with an autoloaded link preview or any other content type a renderer resolves eagerly. Detection is possible — the shape of a markdown image pointing at a URL with data-bearing query parameters is distinctive enough to score highly — but detection is all it is. Recognising the shape does not rewrite the URL, so the real containment lives in the rendering client: a content security policy that forbids third-party image origins, or a link allowlist.

The third is the tool call. An agent persuaded to pass its conversation, its retrieved documents or an environment value into a field of a tool that writes somewhere the attacker can read has exfiltrated through a mechanism your architecture treats as a feature. This is the channel that argument-level policy exists for, and it is the one that scales worst with a permissive tool surface, because every additional writable destination an agent can reach is another egress path that looks exactly like ordinary work.

The fourth is the response stream, and it is a pure implementation trap. A scanner that inspects each streamed chunk independently will miss any value split across a chunk boundary, because half a credential matches no pattern. That is not a theoretical gap: token streams break at arbitrary positions, so a long secret is more likely to be split than not. The fix is a hold-back buffer deep enough that a cut never falls inside an unbroken run of value characters, with an explicit maximum run length past which the run is suppressed to its delimiter rather than guessed at. Token Observe holds back a floor of 64 characters, extends the hold so a cut never lands mid-run, and suppresses any run beyond 4,096 characters wholesale; the residual it does not close is a secret split across two separate upstream stream restarts, which cannot be correlated. Encoding is the companion problem — base64 and similar wrappers defeat any pattern written for the plaintext, which is why unbroken base64 runs are worth scoring at all, and why they are scored low, since ordinary payloads contain them constantly.

The ordering of defences follows from all four. What the agent can reach matters most: an agent with no grant on a tool that writes to the internet has no third channel, and an agent whose retrieved corpus contains no secrets has little worth taking. What leaves matters second: redaction before egress and unconditional masking of credential shapes on the response leg, within the honest bounds of pattern detection. Where it may go matters third: a destination policy that fails closed when it cannot be satisfied, rather than falling back to whatever is available. Detecting the channel is fourth and weakest, because the attacker chooses the encoding and the renderer chooses what to fetch, and neither of those is yours.