LLM data exfiltration is using prompt injection to make a model leak sensitive data it has access to, such as the system prompt, retrieved documents, conversation history, or tool output. The stolen data is often carried out through an output channel the model can render, for example a markdown image or link whose URL encodes the secret and points at an attacker server. The defence is egress control and output sanitisation: block auto-loading of external content, allowlist link and image destinations, and apply least privilege to the data the model can reach.
How does LLM data exfiltration work?
The attacker plants an instruction, often through indirect prompt injection in a document, email, or web page, that tells the model to collect data it can access and encode it into a URL. If the interface renders markdown, a line like an image whose address contains the secret causes the client to fetch that URL from the attacker's server, delivering the data. Links, tool calls, and any output the model can trigger work the same way. The user often sees nothing unusual.
Why LLM data exfiltration matters
This turns a prompt injection into a real breach. RAG systems and agents give models access to internal documents, credentials, and tools, and exfiltration is how that access leaves the building. Because the payload can arrive indirectly and the exfil channel is a normal-looking image or link, both the user and the logs can miss it. It is one of the clearest paths from an AI feature to data loss.
How to defend against LLM data exfiltration
Control egress. Do not auto-load external images or content in model output, allowlist the domains links and images may point to, and strip or neutralise markdown that would fetch external resources. Apply least privilege to what the model can read and which tools it can call, separate trusted instructions from untrusted data, and red-team the full path from injected input to outbound request.
References
- [1]OWASP LLM01:2025, Prompt Injection(OWASP)
- [2]OWASP Top 10 for LLM Applications(OWASP)
- [3]MITRE ATLAS, Adversarial ML tactics(MITRE)
A RAG app or agent without egress control is one injection away from data loss. Talk to a security expert about testing your exfiltration paths.