Attacks / Standard term
Data exfiltration
An attack that tricks an AI system into sending sensitive data to a destination the attacker controls.
A compromised workflow may place private data in a fetched URL, email, API argument, uploaded file, rendered image request, or visible response. The leak path requires both access to the data and a channel that can carry it to an unauthorized recipient. Model-generated arguments add a new way to connect those two capabilities, but ordinary application controls can still block the transfer.
Builder example
Risk is highest when one execution identity can read broad sensitive records and communicate with arbitrary destinations. Narrow record access, field-level filtering, fixed destinations, network policy, and server-side authorization reduce what an injected instruction can expose.
Common confusion: Visible chat text is only one egress channel. Tool arguments, links, attachments, logs, and third-party calls also need controls based on data classification and destination.