Data Exfiltration

Data exfiltration is when a skill sends information from your environment to an attacker-controlled server. The information could be files from your filesystem, environment variables containing credentials, the contents of your conversation with the agent, or data from other tools the agent has access to.

The mechanisms vary. Some skills make direct HTTP requests to external endpoints, encoding stolen data in URL parameters, POST bodies, or DNS queries. Others are more subtle: they embed data in image URLs that the agent renders (the request itself exfiltrates the data), use WebSocket connections that look like legitimate API calls, or write data to shared locations that another process picks up.

Aguara tracks sixteen distinct exfiltration patterns plus an NLP-based detector that catches cases where credential access and network transmission appear together in natural language descriptions. The range matters because attackers are creative. Blocking outbound HTTP is not enough when data can leave through DNS, ICMP, steganography in file uploads, or timing-based side channels.

AI agents are uniquely positioned for exfiltration because they naturally aggregate sensitive information. Your agent might have access to your codebase, your cloud credentials, your email, your Slack messages, your internal documentation. That is the whole point of an agent. It connects to many data sources to be useful.

But that connectivity becomes a liability when one malicious skill can read from those data sources and write to the network. In a traditional application, exfiltration requires both a vulnerability and access to sensitive data. In an agent, every tool potentially has access to everything the agent can see, which is often everything you can see.

The detection challenge is real. A skill that makes HTTP requests to external APIs is normal behavior. A skill that sends data to its own backend is expected. Distinguishing legitimate API calls from exfiltration requires understanding what data is being sent and where. Aguara rules focus on the suspicious patterns: encoding file contents in URL parameters, sending environment variables to non-standard endpoints, accessing credential files and then making network requests.

Apply the principle of least privilege to every skill. A code formatting tool does not need network access. A file search tool does not need to read .env files. If a skill requests permissions beyond what its stated function requires, that is a red flag.

Monitor outbound network activity from your agent. Tools like Little Snitch (macOS) or iptables rules can alert you when unexpected processes make network connections. For MCP servers running locally, you can restrict their network access at the OS level, only allowing connections to documented API endpoints.

When evaluating skills, check what data they access and where they send it. A skill tool definitions should make it clear what inputs it reads and what external services it contacts. If a skill has network capabilities but does not clearly document which endpoints it calls and why, treat it as suspicious. Legitimate skill authors document their API dependencies.