Every guardrail built so far in this course — egress allowlists, scoped tokens, approval gates — exists because of one underlying goal an attacker is almost always working toward: getting data that should stay inside the system out to somewhere they control. Data exfiltration through tool calls is not a new attack category so much as the destination every other technique in this course is trying to reach. A prompt injection that succeeds but produces no exfiltration is an inconvenience; a prompt injection that succeeds and exfiltrates a customer database is a breach, and the difference between those two outcomes is entirely down to whether the guardrails covering the exfiltration path itself were in place.
This matters because exfiltration through an agent's own tools looks nothing like a traditional data breach. There is no password to steal, no database to directly query — the attacker's payload rides inside content the agent is asked to process (a support ticket, a fetched webpage, a document to summarize), and the agent itself, using tools it was legitimately granted, becomes the mechanism that moves the data out. Detecting this requires understanding the specific signatures these techniques leave, not just hoping the model refuses to comply.
OWASP's LLM Top 10 names this class as LLM02: Sensitive Information Disclosure, and separately covers the injection vector that typically delivers it as LLM01: Prompt Injection — this lesson names the concrete technique classes defenders need to recognize, then spends the majority of its content on the detection and containment layer that catches them regardless of which specific technique an attacker uses.
Analogy🏏Cricket
🏏 Think of it like cricket: Match-fixing investigations rarely find a player handing cash directly to a bookmaker in the middle of a stadium — the actual transfer of value happens through channels that look, on the surface, like ordinary cricket activity: a deliberately timed no-ball that signals a pre-arranged outcome to someone watching, a scoring pattern in an early over that matches a spot-fixing bet placed minutes before. The 2013 IPL spot-fixing case that implicated players from Rajasthan Royals was built on exactly this insight — investigators did not look for an obvious handoff, they looked for anomalous patterns in otherwise-normal match actions that correlated with betting activity nobody watching the match itself would have noticed. Just as a fixed no-ball is an ordinary cricket action being used as the actual mechanism of the crime, an agent's own legitimate tool call — sending an email, posting a webhook, writing a log entry — is an ordinary action being used as the actual mechanism of exfiltration. Just as investigators learned to watch for the specific pattern a fixed delivery leaves rather than waiting to catch an obvious cash exchange, defenders have to learn the specific signatures exfiltration techniques leave in tool-call traffic rather than waiting to catch an obviously malicious request. The insight is that the most dangerous version of an attack is the one that looks exactly like the ordinary activity happening all around it — which is exactly why naming the technique's signature, precisely, is what makes it detectable at all.
🏏 Showing the Cricket analogy — a Cricket version isn’t available for this concept yet.