Exfiltration via AI Agent Tool Invocation
Description
AI agent tools capable of performing write operations may be invoked to exfiltrate data to an adversary. Sensitive information can be encoded into the tool's input parameters and transmitted to an adversary-controlled location (such as an inbox, document, or server) as part of a seemingly legitimate action. Variants include sending emails, creating or modifying documents, updating CRM records, or even generating media such as images or videos. The invoked tool itself may be legitimate but invoked by an adversary via LLM Prompt Injection, or the tool may be malicious (See AI Agent Tool Poisoning). AI Agent Tool Poisoning can also be used to manipulate the inputs and destination of a separate legitimate tool, invoked through normal usage by the victim.
Honesty-tier rationale
Exfiltration is mostly bound to real model/inference-API access; some sub-techniques can be shown as concepts (see membership inference), the rest need infrastructure.