Can an AI Agent Exfiltrate Data Through a Markdown Image or URL?
Yes. If the client fetches images or links in the agent's output on its own, data in the URL leaves the session. Check how output is rendered.
Research topic
EchoLeak
Research on EchoLeak: AI agent security, tokenization and checks for sensitive data access before allowing enterprise workflows to run.
Does Prompt Injection Expose Customer Records?
Yes, when the injected agent sees real customer data and can send outward; attacks leaked data at 20 to 70 percent. Check what the model holds.
How Do AI Agents Bypass Company Data Protection Rules?
Not by breaking rules but by passing beneath them: DLP watches files and uploads while an agent reads the screen. Check what sees what the model received.
How Do Malicious Documents Take Control of AI Agent Behavior?
A document carries instructions in white text, metadata and retrieval chunks, and an agent reads them as its task. Check which documents your agents read.
What Is Indirect Prompt Injection and How Does It Reach AI Agents?
An instruction a third party plants in content an agent reads, such as an email, file, web page or tool result, so the attacker never touches the prompt.