> For the complete documentation index, see [llms.txt](https://handbook.harmonic.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://handbook.harmonic.security/handbook/5.-threats-and-adversarial/5.2-data-exfiltration-via-tools-and-connectors.md). # 5.2 Data exfiltration via tools and connectors The injection-to-egress chain uses legitimate tools to move data out, making egress allowlists, connector scoping, and approvals key choke points. *Last reviewed: August 18, 2026* {% hint style="info" %} The common chain is simple: inject the agent, gather data, then send it out through a legitimate tool. Break the chain at tools, egress, or approvals. {% endhint %} ## Data exfiltration via tools and connectors: what security teams need to know Exfiltration in AI systems often uses approved features. A connector can read source data. A browser can open an external page. A messaging tool can send a summary. An artifact can carry data into a shareable output. In OWASP LLM Top 10 terms, this pairs sensitive information disclosure with excessive agency. This makes prevention a chain problem. You do not need every link to be perfect if one link blocks the path. ## Common data exfiltration via tools and connectors security failures * An injected page asks the agent to send retrieved data to a webhook. * Rendered markdown images or links auto-fetch attacker URLs with data packed into query strings. This was the channel used by CVE-2025-32711 (EchoLeak), the zero-click prompt-injection chain in Microsoft 365 Copilot that Microsoft patched in 2025. * A connector write posts sensitive output to a broad channel. * An artifact embeds sensitive data and is shared externally. * A tool call hides exfiltration inside a normal-looking support ticket. * Network policy allows the destination because it is a common SaaS domain. ## Data exfiltration via tools and connectors security controls checklist * Limit tools available after untrusted-content reads. * Require approval for external writes and broad shares. * Use egress allowlists for agent-controlled network access. * Classify outputs before sharing or connector writes. * Alert on unusual connector destinations, large outputs, and new external domains. ## Anthropic ### Overview Anthropic exfiltration review should trace data from Claude prompts, files, connector reads, Desktop extensions, Cowork remote sessions, Office add-ins, local MCP, Claude Code tool calls, API tools, and Managed Agent outputs to any external action. The Office cross-app setting is an outbound path in its own right because context can move from one open file or application into another. Two documented chokepoints matter most. Connectors act with the person's source-system permissions, and Team or Enterprise owners can enable connectors and restrict actions, which narrows what an injected session can write outward. Managed Agents cloud sandboxes run as isolated Linux containers with network access disabled by default, so unattended runs have no egress path unless the environment configuration enables one. In Claude Code, tools that make network requests require user approval by default, and network-fetching commands such as curl and wget are not auto-approved. Claude Tag channel sessions send outbound requests through Agent Proxy. Requests that match no credential rule, domain entry, or environment allowance are blocked, and stored secrets are injected at the proxy rather than exposed to the sandbox. Test all three allow layers, including the environment's Trusted defaults, and treat posting a result back into a broad Slack channel as an exfiltration path even when no external host was called. ### Anthropic documentation * [Use connectors to extend Claude's capabilities](https://support.claude.com/en/articles/11176164-use-connectors-to-extend-claude-s-capabilities) * [Cloud sandbox reference](https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference) * [Claude Code security](https://code.claude.com/docs/en/security) * [Claude Code permissions](https://code.claude.com/docs/en/permissions) * [Use Claude Cowork safely](https://support.claude.com/en/articles/13364135-use-claude-cowork-safely) * [Work across Microsoft 365 apps](https://support.claude.com/en/articles/13892150-work-across-microsoft-365-apps) * [Claude Tag security and data handling](https://claude.com/docs/claude-tag/concepts/security-and-data) ### Applicable Harmonic guides for Anthropic * [Securing Claude Cowork: A Security Practitioner's Guide](https://www.harmonic.security/resources/securing-claude-cowork-a-security-practitioners-guide) ## OpenAI ### Overview OpenAI exfiltration review should trace data through ChatGPT Work, plugins, apps, Sites, Office-native agents, Workspace Agents, Codex MCP/browser/computer use, API tools, and Agents SDK handoffs. Separate app action controls, Site publishing, Office file writes, desktop sandbox and approval policy, API egress, and connected SaaS permissions. Lockdown Mode is the control built for this exact threat: it limits outbound web and external-service access to reduce prompt-injection data exfiltration risk, and managed workspace admins assign it through RBAC roles. It does not affect Codex network access, so Codex egress must be governed separately through sandbox policy, which bounds file, command, and network access. For apps, action control determines whether an app can read only, take actions, or use a custom set of actions: the read/write split that decides whether an app can serve as an outbound path. ### OpenAI documentation * [Lockdown Mode](https://help.openai.com/en/articles/20001061) * [RBAC](https://help.openai.com/en/articles/11750701-rbac) * [Admin Controls, Security, and Compliance in apps](https://help.openai.com/en/articles/11509118-admin-controls-security-and-compliance-in-apps-enterprise-edu-and-business) * [Codex sandboxing](https://developers.openai.com/codex/concepts/sandboxing) * [ChatGPT Work Admin FAQ](https://learn.chatgpt.com/docs/enterprise/work-admin-faq) * [Creating and managing ChatGPT Sites](https://help.openai.com/en/articles/20001339) ### Applicable Harmonic guides for OpenAI * [Securing ChatGPT Enterprise Guide](https://www.harmonic.security/resources/securing-chatgpt-enterprise-guide) * [Securing Codex Best Practice](https://www.harmonic.security/resources/securing-codex-best-practice) ## Frequently asked questions about data exfiltration via tools and connectors ### How do AI agents exfiltrate data? They use normal tools such as connectors, browser actions, external requests, messages, files, or artifacts. Rendering channels count too: a markdown image or link that auto-fetches an attacker URL can carry data in its query string without any explicit send action. CVE-2025-32711 (EchoLeak) showed that class of chain working zero-click against Microsoft 365 Copilot. ### What is the best choke point? Network egress and external write actions are strong choke points because they sit near the end of the attack chain. An attacker can vary how they inject and what they collect, but the data still has to leave through a network path or a write action you can restrict. Egress allowlists and controls such as OpenAI's Lockdown Mode work at this layer. ### Are read-only tools part of exfiltration? Yes. Read-only tools collect the data that another tool later sends out, so they form the first link of the chain. Scoping read access to the task shrinks what a successful exfiltration can take. ### How can DLP help? DLP can detect sensitive content before prompt entry, tool use, output sharing, or external write actions. In agentic systems the most valuable placement is on the outbound side: connector writes, network requests, and shared artifacts. Pair detection with classification so alerts reflect data sensitivity rather than volume. ### What should trigger an alert? Unexpected external domains, new connector write targets, large sensitive outputs, and tool chains that follow untrusted-content reads should trigger review. Sequence matters as much as any single event: a sensitive read followed quickly by a new outbound destination is the signature to catch. ## Applicable regulations and frameworks | Governance page | Relationship to this article | | --------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | G.1 Map your controls to NIST AI RMF and CSF 2.0 | This article supplies implementation evidence for the NIST AI RMF and matching NIST CSF 2.0 outcomes. | | G.3 DORA and AI resilience in financial services | Conditional: for a DORA-regulated workflow, this supports resilience testing, vulnerability handling, and incident response. | | G.5 SANS Critical AI Security Guidelines mapping | This article implements relevant SANS Inference Security, Monitoring, and GRC guidance. | | G.6 Write an AI Acceptable Use Policy that holds up | This article supplies a technical or process control used to enforce the acceptable-use policy. | | G.9 HIPAA controls for AI systems handling PHI | Conditional: for a workflow handling ePHI, this supports HIPAA risk analysis, safeguard testing, and security-incident response. | *G.2, G.3, G.4, and G.9 are conditional mappings. They apply only when the deployment is within the legal or regulatory scope described on the linked governance page.* ## Related handbook guidance * [5. Threats & Adversarial](/handbook/5.-threats-and-adversarial.md) * [5.1 Prompt injection: the connective risk](/handbook/5.-threats-and-adversarial/5.1-prompt-injection-the-connective-risk.md) * [2.1 Connectors and apps: the integration backbone](/handbook/2.-supply-chain-and-extensibility/2.1-connectors-and-apps-the-integration-backbone.md) * [4.1 DLP for GenAI](/handbook/4.-data-protection-and-residency/4.1-dlp-for-genai.md) * [6.6 Evidence by surface and investigation paths](/handbook/6.-observability-audit-and-evidence/6.6-evidence-by-surface-and-investigation-paths.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://handbook.harmonic.security/handbook/5.-threats-and-adversarial/5.2-data-exfiltration-via-tools-and-connectors.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.