AI Agent Data Exfiltration: Prompt Injection, Tools, and Runtime Defense

The short version

AI agent data exfiltration is sensitive data leaving through an agent action or output: tool calls, web requests, APIs, files, screenshots, memory, RAG retrievals, or final answers influenced by prompt injection or agent hijacking.

The dangerous pattern is simple: the agent reads untrusted content, retrieves sensitive data, and sends it through a tool that appears legitimate in isolation. Defense needs untrusted-content isolation, credential scoping, pre-tool call checks, post-tool response screening, outbound URL inspection, covert-channel detection, and audit evidence.

Why exfiltration is different for agents

A normal application usually has clearer code paths for data movement. An agent builds its path at runtime. It reads a page, decides which tool to use, calls an API, sees a result, writes a file, opens a URL, or sends a message. Each step can be normal, while the sequence is malicious.

That is why tool-call data exfiltration is hard to catch with coarse controls. A web request is not automatically suspicious. A file read is not automatically suspicious. The security question is whether this agent should send this content to this destination for this task now.

Prompt injection makes the problem worse because the attacker may never talk to the agent directly. The instruction can sit inside a website, ticket, README, email, MCP result, database row, or search result that the agent processes during normal work.

The common attack path

The classic agentic pattern combines three capabilities: access to private data, access to untrusted content, and access to an outbound channel. Researchers sometimes describe this as the lethal combination for agent security. The agent has enough context to be useful and enough authority to leak what it sees.

A RAG agent data exfiltration attack might work like this: the user asks a harmless question, the agent searches the web, a malicious page contains hidden instructions, the agent retrieves an internal secret from a knowledge base, and the agent sends that secret to a server through the same web or API tool it normally uses.

A coding-agent version might read environment variables or protected files and encode the content into a DNS lookup, URL path, pasted issue comment, test artifact, or final answer. A business-agent version might attach invoice summaries, customer data, or internal notes to a third-party enrichment request.

A practical exfiltration-defense checklist

Where runtime controls fit

Static review, identity governance, DLP, network controls, sandboxing, and MCP server review all matter. They reduce the agent's authority and make exfiltration harder. They still cannot inspect every live action after the agent has read fresh untrusted content.

Runtime controls sit on the action boundary. They inspect the proposed tool call before it executes and the returned content before it becomes new model context. That lets the runtime catch credential-looking values, protected paths, suspicious destinations, encoded payloads, and output leakage when the exact action is known.

Clawmont maps that category to OpenClaw. It does not replace an enterprise DLP platform, CASB, SIEM, identity governance, network egress gateway, or incident-response program. It helps locally by checking OpenClaw inputs, tool dispatch, tool responses, outputs, credential-looking content, outbound URLs, protected paths, and audit evidence.

What the source trail says

OWASP's AI Agent Security Cheat Sheet explicitly calls out data exfiltration through tool calls, API requests, and outputs, and its prompt-injection guidance explains the root design problem: natural language instructions and data are not reliably separated.

AgentDojo and the NIST AgentDojo-Inspect dataset frame agent hijacking as indirect prompt injection against agents that execute tools over untrusted data. The relevant test is not whether the model gives a bad answer. It is whether the model takes a harmful action after reading hostile content.

Recent research on web search tool exfiltration shows the same structure in a RAG-like workflow: a malicious web page can instruct an agent to retrieve internal data and transmit it outward through a legitimate tool path.

Unit 42's 2026 research adds an important real-world signal: web-based indirect prompt injection is now observed in the wild, not only in proof-of-concept demos. Microsoft Incident Response's MCP tool-poisoning example gives the enterprise version, where every individual action may look legitimate while the chain still moves sensitive records to an attacker-controlled endpoint.

Related reading

• AI agent security runtime
• AI agent runtime security definition
• Agentic security guide
• AI agent runtime security checklist
• MCP tool poisoning runtime defense

Source context

These sources are useful because they connect the same chain from different angles: OWASP taxonomy, prompt-injection mechanics, agent-hijacking benchmarks, RAG/web-search exfiltration research, in-the-wild indirect prompt injection, and enterprise MCP data-loss examples.

• OWASP AI Agent Security Cheat Sheet
• OWASP LLM01 Prompt Injection
• Exploiting web search tools of AI agents for data exfiltration (preprint)
• AgentDojo prompt-injection benchmark for tool-using agents (preprint)
• NIST AgentDojo-Inspect dataset
• Prompt injection benchmark and defense framework for RAG-enabled agents (preprint)
• Attack and defense landscape of agentic AI survey (preprint)
• Unit 42 research on web-based indirect prompt injection in the wild
• Microsoft Incident Response on agents moving from reading to acting

FAQ