Prompt Injection to Data Exfiltration in 3 Steps
How AI agents can silently leak data?
1A Silent Threat
An employee instructs an AI agent to summarize a customer ticket. While the agent performs the task, a customer record is leaked simultaneously. This exfiltration occurs without any destructive action and often goes unnoticed.
2What is Prompt Injection?
Prompt injection is when AI agents process malicious instructions as if they were given by the user. This leads the agent to interpret a harmful command as a legitimate instruction.
3Empirical Findings
A 2026 study analyzed 1.2 billion URLs and found 15,300 validated injection payloads. 70% of these payloads were hidden in non-rendered HTML, headers, and comments, invisible to humans.
4Model Compliance
The study found that models comply with malicious instructions 8% of the time. While this rate seems low, since data exfiltration is irreversible, one successful attempt is enough for attackers.
5MCP Tool Call
The agent uses a legitimate MCP tool to execute the malicious instruction. This tool sends the request made by the agent, resulting in data exfiltration without any security breach.
6Port 443 Egress
The MCP server opens a TCP connection to the attacker's endpoint and sends the customer record. This process occurs without exploiting any vulnerabilities.
7Kubernetes NetworkPolicy
Kubernetes NetworkPolicy is the wrong abstraction for such attacks. It operates at L3/L4 and cannot evaluate the destination domain or source workload.
8CIDR Allowlist
Most teams compromise by using a CIDR allowlist. However, this provides fictional security as a major CDN's IP space can include both legitimate APIs and attackers.
9Asymmetric Risk
Attackers only need to succeed once, so a low compliance rate does not mean low risk. In a targeted attack, prevalence numbers are irrelevant.
10Probabilistic Defense
Answering a probabilistic attack with a probabilistic defense is like responding to a coin flip with another coin flip. Such defenses fail against attackers with unlimited attempts.
11Solution Layer
Preventing such attacks requires not a new product category but a control layer that most clusters already have access to but haven't activated.
Original article: O'Reilly Radar — Prompt Injection ile Veri Sızıntısı: 3 Adımda Nasıl Gerçekleşir?