Data Exfiltration

This is a controlled academic study (not an active exploit) showing that when an agent pulls data via MCP and then relays it to another agent via A2A, simply attaching a 'PUBLIC - OK TO SHARE' label to a record can increase the odds that sensitive substantive field values are copied verbatim into outbound messages, compared to unlabeled data. The effect is strongly model-dependent (pronounced in one Claude model, weaker or floor-limited in GPT-5.6 tiers) and the paper is explicit that this is an association in one configuration, not a proven general or causal effect. Severity is modest because it is a research finding highlighting a labeling/trust-heuristic weakness rather than a demonstrated in-the-wild attack.

Updated Sep 3, 2026

Boruta, an OAuth2/OIDC authorization server, logged sensitive credentials including access tokens, refresh tokens, ID tokens, and agent tokens in plaintext business event logs prior to version 0.10.0. Anyone with access to these logs, log aggregation pipelines, or the admin log viewer could extract valid tokens and reuse them for unauthorized access until expiration or revocation. This is a credential-hygiene vulnerability rather than a novel agent-specific attack, but it directly threatens agent-to-service authentication where 'agent tokens' are among the logged values.

Updated Sep 3, 2026 · CVSS 6.5

This is a defensive research paper, not an active exploit. It quantifies how LLM agents habitually over-share privacy-sensitive data in tool call arguments (81-88% of calls) and proposes ToolMinimize, a middleware that rewrites arguments to the minimum necessary data. The finding highlights a systemic data-hygiene weakness in agent-to-tool interactions rather than describing a novel attack technique.

Updated Aug 27, 2026

Infracost, a cost-analysis tool used alongside AI coding agents and CI/CD pipelines, could be tricked into sending a configured Terraform Cloud or registry token to an attacker-controlled host. This happens because the tool derives the destination hostname from untrusted Terraform input (e.g., in a pull request) rather than validating it against the trusted host configuration. The issue is fixed in version 0.10.45.

Updated Aug 22, 2026

The CKAN MCP Server, prior to version 0.4.112, leaks raw upstream response bodies and internal exception details (hostnames, internal IPs, DB errors, stack fragments) to callers when errors occur or when the server is redirected to a non-CKAN host. This is a low-severity information disclosure issue rather than a direct compromise vector, but it can aid reconnaissance for further attacks, especially if combined with SSRF-style redirection. The vendor has already released a fix.

Updated Aug 14, 2026 · CVSS 3.7

Researchers found that encrypted reasoning/chain-of-thought blocks returned by proprietary LLM APIs (OpenAI, Anthropic, Google) used the same encryption key across models within a family, allowing an attacker to capture a strong model's encrypted reasoning trace and replay it into a weaker sibling model to trick it into decrypting and outputting the plaintext hidden reasoning. This exposed internal chain-of-thought content never intended for end users, including a related technique to induce models into reasoning about data exfiltration steps. Vendors have since patched the flaw, reducing current risk, but it demonstrates a real and previously unknown extraction/jailbreak vector.

Updated Aug 12, 2026

This is a research paper (not an active exploit) demonstrating that proprietary 'skills' offered by AI agent platforms can have their hidden functionality functionally cloned purely through legitimate use, without ever disclosing the underlying files. The method, SkillClone, builds an interface hypothesis from public documentation, probes the skill with structured benign queries, and iteratively synthesizes and repairs a replica using differential validation against real outputs. This shows that file-disclosure defenses are insufficient to protect proprietary agent logic, since functional secrecy can be broken through cumulative, non-malicious-looking interactions.

Updated Aug 6, 2026

Flowise's GET /api/v1/upsert-history endpoint fails to scope results to the requesting user or workspace, instead returning the entire server-wide upsert history, including vector store credentials/configuration like Qdrant server URLs and collection names. Any authenticated (and possibly under-authorized) user can harvest infrastructure details belonging to other tenants, enabling follow-on targeted attacks against those backends.

Updated Aug 4, 2026

n8n workflows using LLM sub-nodes (OpenAI, Anthropic, Lemonade) with custom HTTP header credentials write those header values in plaintext into stored execution data, even though the n8n UI masks them. Any user with access to execution logs or exports can recover API keys and secrets, which may persist in the database well after the workflow run completes.

Updated Jul 23, 2026

This is a follow-up disclosure from Embrace The Red detailing how an LLM agent that outputs untrusted content into a macOS Terminal could be leveraged to trigger DNS requests via crafted ANSI escape sequences, effectively exfiltrating data through DNS lookups. Apple has since fixed the underlying macOS Terminal behavior, so this report documents a resolved vulnerability rather than an active ongoing threat. Severity is moderate given the fix is already deployed, but the technique remains relevant for agents/tools still rendering raw terminal output without sanitization.

Updated Jul 17, 2026

AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 logged raw user prompts and full agent responses into OpenTelemetry span attributes without any filtering or masking, which then flowed into customer CloudWatch aws/spans log groups. Any principal with read access to those logs could view sensitive user content, including secrets or PII that may have been part of prompts or agent outputs. This is a data exposure issue rather than an active exploit, and requires local/authenticated access to the customer's own logging infrastructure.

Updated Jul 16, 2026 · CVSS 5.7

The dbt-mcp server, prior to 1.17.1, sent full unredacted MCP tool call arguments—including raw SQL queries, variables, and node selection strings—to a third-party telemetry backend by default. Because usage tracking was enabled unless explicitly disabled via environment variables, organizations may have unknowingly leaked sensitive query content and internal data model details. This is a legitimate but low-complexity data exposure issue, not a remote code execution or agent-hijack vulnerability.

Updated Jul 16, 2026 · CVSS 3.1

The dbt-mcp MCP server, prior to version 1.17.1, logged raw tool call arguments—including SQL queries, variables, and node selections—in plaintext to a local log file when file logging was enabled. This is a genuine but low-severity information disclosure issue requiring local file access or misconfigured log exposure to exploit, with a CVSS score of 2.5 and an official fix already released.

Updated Jul 16, 2026 · CVSS 2.5

xAI's Grok Build CLI coding agent was found to upload the entire working directory (and in one reported case, a user's home directory including SSH keys and password manager databases) to xAI's Google Cloud storage without clear user consent. xAI disabled the feature, deleted retained data, and open-sourced the codebase in response to backlash, but this represents a serious real-world data exfiltration incident caused by an overly broad and opaque agent tool/data-retention design rather than a targeted attack.

Updated Jul 16, 2026

A researcher discovered a loophole in Anthropic's Claude web_fetch tool that allowed a malicious website to exfiltrate private user data (name, location, employer) by chaining together a sequence of attacker-controlled links discovered within previously fetched pages. This bypassed the intended safeguard that web_fetch could only follow user- or search-originated URLs, effectively encoding stolen data letter-by-letter into a series of outbound requests. Anthropic has since patched the issue by disallowing navigation to links found within fetched content.

Updated Jul 15, 2026

The OpenAI Codex desktop app for macOS automatically fetched remote images referenced in Markdown model output, which an attacker could exploit via indirect prompt injection to leak sensitive session data (API keys, source code, tool outputs) to an attacker-controlled server. No user click was required, making exfiltration silent and automatic. This is a genuine, credible vulnerability with clear exploitation mechanics, though no in-the-wild exploitation has been observed.

Updated Jul 7, 2026

SUSE Rancher AI Agent versions before 1.0.2 write API keys and raw LLM response text to log files when DEBUG loglevel is enabled, exposing sensitive data to anyone with local log access. This is a configuration/logging hygiene flaw rather than a novel agentic attack technique, and requires local access plus DEBUG mode to be exploitable. Severity is moderate because it enables credential theft and downstream misuse, but exploitation requires elevated local access and a non-default log setting.

Updated Jul 6, 2026

This item is a retrospective and largely positive report: OpenAI published a paper detailing mitigations for a long-known zero-click data exfiltration technique in which a language model can be manipulated into rendering attacker-controlled URLs (e.g., markdown images) that leak conversation data to an external server. The underlying vulnerability class was disclosed by the author nearly three years ago and was already mitigated by Microsoft in Bing Chat in 2023; this post covers OpenAI's newer, more formal write-up of defenses. Severity is moderate rather than critical because this is historical/defensive reporting on a well-understood, largely mitigated issue rather than a new active exploit.

Updated Jul 5, 2026