AsrielNetworksData exfiltration
Sensitive data leaving through the model's output or a tool call: rendered links, encoded payloads, outbound requests, or plain disclosure.
Definition
Data exfiltration through an AI system is sensitive data leaving by a path the model controls: repeated back in an answer, embedded in a link or image URL the client will fetch, encoded into a tool argument, or sent by a tool that can make outbound requests. The data may come from the prompt, from retrieved documents, from a tool result, or from the model's own weights.
What makes it distinct from classic DLP is the carrier. A model can be induced to encode secrets into innocuous-looking output, and an agent with a browsing or HTTP tool can deliver them without the user seeing a thing. The output channel and every tool with a network side effect are exfiltration paths.
How it manifests
- Scanner hits on output: credentials, keys, personal data or classified markers in
response.generatedortool.execution.completed. - Rendered links and images whose URL carries data in the query string, especially to an unfamiliar host.
- Tool calls with oversized or encoded arguments to messaging, HTTP or storage tools.
- A clean final status that hides the transfer: the session ends “completed” while the trace holds a blocked or risky effect.
How AsrielNetworks detects it
The sensitive-exposure rule uses the structured verdicts of your scanners and policies on model output and tool transfers, and never needs the raw value stored to fire. The concealed-action rule closes the other half: a benign final status whose trace contains risky or blocked effects that the summary omitted, which is how an exfiltration that was stopped, or one that succeeded quietly, still surfaces as an incident.
- Sensitive data exposure
ai.data.sensitive_exposure· high
Scanner and policy signals on outputs and transfers, evaluated without storing the raw values. - Concealed action risk
ai.action.concealment_risk· medium
A benign final status that omits risky or blocked effects recorded earlier in the trace.
References
- OWASP GenAI Security Project, LLM02:2025 Sensitive Information Disclosure.
- MITRE ATLAS, AML.T0057 LLM Data Leakage.
- Rehberger, Embrace The Red, documented image and link exfiltration in production assistants.
- Carlini et al., Extracting Training Data from Large Language Models (2020).