Data exfiltration through prompt injection does not require a network vulnerability or a leaked credential. It requires convincing a model that already has legitimate access to sensitive context to include that information somewhere the attacker can see it, or to send it somewhere the attacker controls. This is a meaningfully different attack than a traditional data breach, because the model's access to the data was authorized; the exfiltration happens through the model's own output rather than through unauthorized access to a system.
The direct path: getting the model to state it
The simplest exfiltration mechanism is convincing the model to include sensitive information directly in a response the attacker can read. If a customer support assistant has access to account details for the purpose of answering the current user's questions, and an injected instruction convinces it to reveal details about a different account, or to summarize its full system prompt including any embedded configuration or sensitive context, the attacker gets the data simply by reading the model's answer. No further mechanism is needed.
This path is why minimizing what sensitive data enters a model's context in the first place matters as much as controlling what the model is allowed to do with it. Data that never enters the context cannot be exfiltrated through this path, regardless of how the model is manipulated.
The indirect path: exfiltrating through a tool call
A more sophisticated mechanism uses a tool the model can call to send data somewhere outside the immediate conversation. If an agent has a tool that can send an email, post to a webhook, or write to an external system, an injected instruction can direct the model to include sensitive context as part of that tool call's parameters, effectively using an authorized action as a channel to move data to a destination the attacker controls.
This path is often more damaging than the direct path, because it does not require the attacker to be reading the conversation directly. A single successful injection that triggers an outbound tool call can exfiltrate data without the attacker needing any ongoing access to the application at all.
The subtle path: exfiltrating through crafted URLs or requests
Some exfiltration techniques encode data into a URL, a query parameter, or a request that the model is convinced to construct and that some downstream system then fetches or processes, effectively smuggling data out through a side channel that was not designed to carry information, such as encoding sensitive values into what looks like a legitimate-seeming link the model generates in its response.
This path is harder to detect because the exfiltrated content is disguised within something that otherwise looks like a normal, expected output, such as a hyperlink or a formatted reference, rather than an obvious block of sensitive text.
Why minimizing context is the most reliable control
The most reliable defense against all three paths is reducing what sensitive data ever enters the model's context in the first place. Redacting or tokenizing values that are not strictly needed for the current task, filtering retrieved content by the requesting user's own access rights, and avoiding including full records when only a specific field is needed all reduce the amount of exfiltratable data present, regardless of which exfiltration mechanism an attacker eventually tries.
This control works even against exfiltration techniques nobody has thought of yet, because it does not depend on recognizing a specific attack pattern. It simply ensures there is less to leak.
Controlling outbound tool calls specifically
For the indirect and subtle paths, controlling what any outbound-capable tool is allowed to send matters as much as controlling what triggers it. Validating that a tool call's parameters do not contain unexpected patterns consistent with sensitive data, restricting which destinations an outbound tool can reach, and requiring approval for outbound actions involving sensitive data categories all reduce the chance that a successful injection actually results in data leaving the system, even if the injection itself succeeds at the language level.
Monitoring for exfiltration attempts
Because exfiltration through prompt injection does not look like a traditional data breach, monitoring needs to specifically watch for patterns associated with it: outbound tool calls with unusual destinations, responses containing content that matches patterns for sensitive data categories, or requests that closely follow a pattern known to precede exfiltration attempts, such as a request asking the model to repeat its full context or system instructions verbatim.
Where TELEON fits
TELEON's policy enforcement at the tool-call boundary can apply limits and approval requirements specifically to outbound-capable tools, applied through the gateway or supported middleware, and its audit trail supports detecting patterns consistent with exfiltration attempts across agent activity. Its privacy vault tokenization can also reduce what sensitive data is present in plain text within a model's context in the first place.
Deciding what data is sensitive enough to warrant tokenization or exclusion, and which outbound destinations should be restricted, still requires judgment from the team that understands the data and the business context.
A short checklist
- Minimize sensitive data entering a model's context to only what the
current task strictly requires.
- Filter retrieved content by the requesting user's actual access rights.
- Restrict and validate outbound tool call destinations and parameters.
- Require approval for outbound actions involving sensitive data
categories.
- Monitor for patterns consistent with exfiltration attempts, not just
general anomalies.
Prompt injection causes data exfiltration by turning a model's authorized access into an unauthorized disclosure channel. Reducing what the model has access to, and controlling what any outbound-capable tool can actually send, closes this path more reliably than trying to detect every possible exfiltration phrasing after the fact.