Exfiltration is a property of a sequence, not of any single action: DLP, RBAC and EDR each report nothing while the data leaves.

The mechanism

Controls anchored to actions cannot see an event that is a path. A database read is innocuous. An external send is innocuous. A database read followed by an external send is a candidate exfiltration event, and no inspection of either step alone reveals it. That sentence, from a March 2026 runtime-governance paper, is the most useful thing anyone has written about this failure; it explains why three separate security investments all come back clean.

Two channel families carry the data out, and they fail differently.

Tool-based exfiltration uses something the agent is allowed to do: curl, an outbound email, a calendar invite. OWASP’s 2026 agentic top ten works the case where a security agent chains PowerShell, cURL and internal APIs after an injected instruction. Every command runs through trusted binaries under valid credentials, so endpoint monitoring sees no malware and no exploit. A neighbouring scenario carries data out over DNS queries from a ping tool somebody marked no-risk and auto-approved.

Rendered-markup exfiltration is worse, because it survives the control most firms reach for first. The agent emits a markdown image whose URL contains the data; the chat client fetches it on render. The agent never makes a network call, so a network=none sandbox is irrelevant: the request comes from the client. MATRA’s OpenClaw threat model rates this scenario Very High with Docker sandboxing enabled, and points at the production instance: EchoLeak (CVE-2025-32711, disclosed 2025-06-11), a zero-click leak from Microsoft 365 Copilot that got past the injection classifier, link redaction and CSP without anyone clicking anything.

Three assumptions die here, and they are the ones citizen developers hold hardest.

The user will notice. Not when the payload is hidden in non-printing characters inside an email the user read and approved. Microsoft’s red team found the plain version of the attack announces itself: asked to forward mail, the agent tends to mention the forward in its reply. The refined version does not, replying normally to the real sender and then quietly forwarding the thread, so the signal to look for is a second, unremarkable outbound message.

Our data classification will hold. Labels vanish in agent-to-agent handoff. Microsoft documents a system whose output controls correctly block classified data, defeated because the metadata was lost in the handoff. The data surfaced in the agent’s justification of its decision rather than in the answer, so a filter watching the answer was watching the wrong field.

The blast radius is our data. It is the union of everything the agent connects to. A compromised MCP server can drive tool calls on a second server and carry the second server’s data out through its own channels; the attacker inherits reachability they never had.

The base rates offer little reassurance. A May 2026 measurement study of 7,973 live remote MCP servers found 40.55% exposing tools with no authentication at all, including an internal-only CRM server leaking 5,000+ real customer records to anyone who connected.

What to do

Enumerate the outbound channels per agent, and count rendered output as a channel. Most teams list the network calls and stop. The list is complete only when it includes what the agent can cause a client to fetch, and what it can send through a sanctioned business tool. OWASP’s worked copilot case exfiltrates via a calendar invite, which no egress proxy will ever see as suspicious.

Then default-deny the destinations, per egress control, and put an expiry on every allowlist entry, because an allowlist is a perishable asset and nobody owns re-checking it. ForcedLeak is the cautionary detail: an injection placed in the Description field of a public Web-to-Lead form exfiltrated Salesforce Agentforce CRM records to a lapsed Salesforce-adjacent domain still sitting on the CSP allowlist, which researchers bought for about five dollars.

Enforce at the retrieval boundary rather than the output boundary. Output filters depend on labels that agent hops destroy; retrieval scoping does not. See data access governance.

A firm that bought no-logging terms from a model vendor should reopen that decision now. Chan et al. put zero-retention offerings under risks for exactly this reason: no-training terms cost nothing in visibility, no-logging terms cost the evidence, and the two are worth splitting in negotiation.

How you’d know it’s working

Plant a canary record in every store an agent can read and alert on its movement. It is the only test here that produces a signal rather than an absence.

Build the detection on the sequence, not the payload: read-then-send inside one session, or a second outbound message following a reply. Content inspection will not find data that left inside an image URL.

Then check whether any of it is visible at all. Run one authorised exfiltration attempt and ask where it showed up. If the answer is “nowhere, but we think it worked,” the finding is a logging gap, not a security control. See logging and audit.

What this doesn’t solve

Output monitoring cannot catch steganographic leakage even in principle. Models exchange messages covertly under equally capable overseers, and the ability improves with scale; the worked example in the literature is a finance agent encoding insider information into innocuous prose. That is a research demonstration, not a production incident, but it bounds what any content filter can promise.

Formal data-flow control degrades the channel rather than closing it, and degraded still leaks. CaMeL, the strongest published design here, documents its own side channels: an attacker counting fetches in their web logs, or reading one bit from a conditionally thrown exception, both of which its authors note are low-bandwidth and complex to run.

Vendor-side leakage is a different problem with a different owner. Asana’s MCP server exposed roughly 1,000 customers’ data across tenants in June 2025 through a broken isolation check: no injection, no agent misbehaviour, just new code with new bugs. That belongs to supply chain vetting.

And none of this touches the free-tier problem. A BlackFog/Sapio survey of 2,000 UK and US employees (November 2025, vendor-sponsored) reports about a third using free versions of tools their own employer had approved, with 33% pasting in research or datasets and 23% financial information. No agent is involved. The data is gone under the consumer terms of a product the firm already said yes to.

See also

• When to involve legal and compliance — customer data leaving the firm starts a 30-day Reg S-P notification clock, and it runs from the firm’s awareness.

• Egress control — the first leg to cut, and why it misses rendered output.

• Data access governance — shrinking what the agent can read, the only control the label-loss problem doesn’t defeat.

• Prompt injection and goal hijack — the usual trigger upstream.

• The lethal trifecta — why read access plus egress plus untrusted input is one condition rather than three.

• Logging and audit — sequence-level evidence, without which none of the signals above exist.

• Supply chain vetting — for the leaks that are the vendor’s bug rather than the agent’s behaviour.

• Threat-modeling a citizen agent — the channel-by-channel enumeration this page asks for, worked end to end.