Skip to content
The Injection_
LIVE
LIVElast sweep next in--:--:--

[ RSS ][ JSON ][ llms.txt ]

Data exfiltration

Also called: exfiltration · data leak

Data exfiltration in AI systems is getting sensitive data out of a model's context, connected tools or environment to an attacker. It is the usual goal of prompt injection: the model is tricked into sending secrets, files or chat history somewhere the attacker can read them.

How it works

Common channels are links and images rendered in output (data packed into a URL the client fetches), tool calls that send email or make web requests, writing to shared documents, and DNS or HTTP requests from code execution. Any action that reaches the outside world can carry data.

How to defend

Block automatic loading of external images and links in AI output, restrict network egress from agents and sandboxes, require approval for outbound actions, and keep secrets out of the model's reach.

Real cases 4 stories

  1. MED

    Attack · AIR Security

    VerCellBreak: a client certificate carries data out of Vercel Sandbox

    VerCellBreak moves data out of Vercel Sandbox past its domain allowlist. AIR Security hid a secret in a client certificate's Authority Information Access URL, and the allowed server fetched that URL while validating the chain.

  2. MED

    Attack · Zenity Labs

    SalesBleed: zero-click CRM data theft through Salesforce Agentforce

    SalesBleed is a Zenity Labs attack in which one web form lead carrying a prompt injection made Salesforce Agentforce leak Accounts data through DNS with zero clicks. Salesforce hardened its Trusted URLs filter in August 2026.

  3. HIGH

    Vulnerability · Embrace The Red · CVE-2026-65669 · CVSS 9.6

    SQL Server Copilot: prompt injection escalates a user to sysadmin

    CVE-2026-65669 let indirect prompt injection push GitHub Copilot in SQL Server Management Studio past its read-only mode and run T-SQL with a sysadmin's privileges. Microsoft rates it CVSS 9.6; SSMS 22.8.2 fixes it.

  4. LOW

    Vulnerability · Check Point Research

    ChatGPT sandbox: shared package cache leaked data across accounts

    Check Point Research found that ChatGPT code containers from different accounts shared one internal JFrog Artifactory, giving attackers a hidden channel into a victim's session and connected apps. OpenAI shut the instance down.