Data exfiltration
Moving data the attacker should not have out to somewhere they control. In agent contexts the channel is rarely a file upload — it is a URL the agent is told to fetch with the secret in the query string, a markdown image whose source encodes the data, a commit pushed to an attacker's fork, a webhook call, or a "diagnostic" parameter on an otherwise-legitimate tool. Because the agent makes the request itself, the traffic looks like normal, authorised tool use.
See also lethal trifecta · action layer · content-free detection
Related terms
-
Lethal trifecta
Attack concepts
Simon Willison's name for the combination that turns an agent into an exfiltration engine: (1) access to private data, (2) exposure to untrusted content…
-
Action layer
Agents & architecture
The enforcement surface at the tool call, as opposed to the prompt layer, which tries to classify text before the model sees it.
-
Content-free detection
MoorAI terms
Analysis that happens on the device, where only the verdict leaves it — a category, a risk level, a decision and a keyed one-way hash — never the prompt…
Attack concepts
The mechanisms the families above exploit, plus the agent-specific ones that have no chatbot equivalent. If you only read one entry on this page, read indirect prompt injection.