Skip to content
Early access: the full platform is free until general availability.See plans
ExfilPath

Research

We built the tool around how agent breaches actually happen.

Every detector in ExfilPath comes from a specific observation about real disclosures and real agent code. This page documents that reasoning, and the sources it rests on, so you can argue with it.
Public disclosuresFramework reviewDetector derivation

What we concluded

Five findings that shaped the engine.

Component correctness does not compose

In both public breaches, no component was misconfigured. The classifier ran, redaction ran, the CSP was enforced. The exploit came from the arrangement: untrusted text could reach an action with an outward effect. Any tool that grades components in isolation cannot see that.

The model is a boundary, not a filter

Text that arrives as data leaves the model as instructions. Treating a model call as neutral middleware is what makes so many findings look harmless. We propagate taint through the call and raise severity when it happens.

The exfiltration channel is usually rendering

Both breaches ended in an auto-fetched image request rather than an explicit HTTP call. That is why rendered model output is a sink in our model, not a formatting concern.

Allowlists only work when the code resolves against them

ForcedLeak used a domain that was still on a trusted list. A list is a guard only when the destination is checked against it at the point of egress, which is exactly what the engine looks for.

Classifiers are partial guards at best

EchoLeak evaded a production prompt-injection classifier by writing to a human reader. We score injection detection as a partial guard: useful, not closing.

Why routes matter

Two breaches where every component was configured correctly.

Both were reachable routes rather than misconfigurations, and both are the shape ExfilPath looks for.

EchoLeak

CVE-2025-32711

Microsoft 365 Copilot · Disclosed June 11, 2025 · found by Aim Labs (Aim Security)

A single crafted email could make Copilot pull sensitive context and send it to an attacker-controlled server with no user interaction. Aim Labs described it as an LLM scope violation, and it is widely reported as the first zero-click prompt-injection exploit against a production AI system.

  1. 01 A benign-looking email lands in the mailbox and phrases its instructions for a human reader, so the cross-prompt injection classifier does not flag it.
  2. 02 Copilot retrieves that email as ordinary context while answering an unrelated question.
  3. 03 The hidden instructions make Copilot embed sensitive context into a reference-style Markdown image, a form that link redaction did not strip.
  4. 04 The client fetches the image automatically, and a Microsoft Teams preview endpoint allowed by the content-security policy proxies the request out.

The lesson: Every component behaved as configured. The exposure was that an untrusted mail body could reach an output channel the client fetches on its own.

In ExfilPath terms: Inbound mail is an input surface, rendered media in model output is a sensitive action, and neither redaction nor a classifier fully covers the value — so this shape reports as an open critical path.

Aim Labs write-up ↗NVD entry ↗Technical analysis (arXiv) ↗

ForcedLeak

CVSS 9.4 vulnerability chain

Salesforce Agentforce · Disclosed September 2025 · found by Noma Labs (Noma Security)

Instructions placed in the Description field of a public Web-to-Lead form were executed when an employee asked Agentforce to process the lead. CRM data was then exfiltrated through an image request to a domain still on the trusted list — a domain the researchers noted could be bought for about five dollars.

  1. 01 An attacker submits a lead through the public form with instructions inside a free-text field.
  2. 02 An employee asks the agent to qualify the lead, and the agent ingests the field as context.
  3. 03 The agent follows the embedded instructions and queries CRM records.
  4. 04 The result is appended to an image URL on an expired but still-trusted domain, and the request carries the data out.

The lesson: Public form input reached an action that could both read records and make outbound requests. Salesforce began enforcing Trusted URL allow lists for Agentforce and Einstein generative AI agents on September 8, 2025.

In ExfilPath terms: A CRM free-text field is an input surface, an outbound request is a sensitive action, and a trusted-URL list only closes the route when the code resolves the destination against it.

Noma Labs write-up ↗Noma Labs summary ↗

The shape

Written as a rule, both breaches are the same finding.

This is the pattern ExfilPath reports, independent of vendor or framework.
the patterntext
IF   a value originates from a surface an attacker can write to
AND  that value reaches an action with an outward or destructive effect
AND  no guard covers the value between those two points
THEN there is a path, and the severity follows the action.

Crossing a model call does not break the chain — it strengthens it,
because data on the way in becomes instructions on the way out.

Reading list

Primary sources.

We link the original disclosures rather than summaries wherever possible.

Working with us

If you are researching agent security, we want to compare notes.

We are happy to run the analyzer over a corpus, share detector logic, or review a finding before you publish. Write to hello@exfilpath.tech.
Try the analyzerContact the team