AI risk
Risk type: Tool Risk
AI plugins and tool data exfiltration
AI data exfiltration is data leaving through AI tool access. Plugins, connectors, and MCP servers widen the path. Injected instructions can trigger it.
OWASP calls the enabling vulnerability excessive agency. That means too much functionality, permission, or autonomy. Grant each tool the least access it needs. Require approval before data leaves your organization.
Last updated
2026-10-30
Where AI tools leak data, and the first control
| Channel | How data leaves | Example | First control |
|---|---|---|---|
| Rendered images and links | The model writes a URL that carries data. Loading it sends the data. | OWASP’s LLM01 scenario plants such a link through a summarized page. | Block automatic loading of external images and links. |
| Connector write scopes | A connector can post, send, or share. | An injected instruction emails a file outside. | Grant read-only scopes by default. |
| Tool calls to outside URLs | The agent fetches from or posts to an attacker’s server. | A page tells a browsing agent to submit a form. | Allowlist outbound destinations. |
| MCP token misuse | A server forwards tokens never issued to it. | The MCP guidance calls this token passthrough. | Reject tokens not issued to your server. |
| Assistant retrieval | Crafted content steers what the assistant retrieves. | CVE-2025-32711 (EchoLeak) in Microsoft 365 Copilot, mitigated by Microsoft. | Limit what the assistant can retrieve and send. |
Drawn from OWASP, the MCP security guidance, and Microsoft. Sources checked October 30, 2026.
Affected tools
- AI chat tools with plugins or connectors
- MCP servers and clients
- AI agents with tool access
- Browser copilots
How it usually happens in the browser
- Users enable connectors that read and write work data.
- Injected instructions make the AI pull extra data.
- The tool sends results to an external service.
- The browser becomes the action layer for clicks and transfers.
- Scopes stay broad when nobody reviews them.
- A local MCP server runs with the user’s privileges.
What traditional defenses miss
- Plugin scopes often get approved without review.
- Audit trails span many separate SaaS logs.
- Users rarely know what a connector can reach.
- Self-enabled tools bypass central review.
- Token passthrough breaks audit trails, per the MCP spec.
Mitigation checklist
- Inventory every plugin, connector, and MCP server in use.
- Approve high-risk scopes centrally, not per user.
- Grant least privilege for reads, writes, and actions.
- Require human confirmation before data leaves the organization.
- Make MCP servers reject tokens not issued to them.
- Run local MCP servers in a sandbox with minimal privileges.
- Revoke unused plugins and stale grants on a schedule.
Where browser isolation fits
- Shield runs the page in a browser that is not on your computer, destroyed when you close the tab.
- Use Shield for destinations a tool or plugin suggests.
- Isolation does not limit what a connector can send.
- Agent builders reach the same routing and isolation through a ready skill.
- Your agent stack still owns its permissions and logs.
Limits
- Each connector has its own scopes and logs.
- The MCP rules cover protocol behavior, not server code quality.
- EchoLeak is one disclosed case, not a trend measure.
- We did not test any plugin or MCP server.
FAQs.
What is AI data exfiltration?
It is data leaving through an AI tool’s access. The path runs through plugins, connectors, or agent actions. An injected instruction can trigger it.
Can a web page make an AI agent leak data?
Yes, OWASP documents the pattern. A page hides instructions for the model. The model then inserts a link that leaks the chat. Agents with tools raise the impact.
Are MCP servers safe to connect?
Treat each server as code that runs with your privileges. The MCP guidance forbids token passthrough. It also warns about local server compromise. Read the exact command before you connect.
How do I audit my AI assistant’s app access?
List every connected app and its scopes. Remove apps nobody uses. Downgrade write scopes to read where you can. Repeat after each new integration.
How does prompt injection relate to exfiltration?
Injected instructions can tell a tool to send data. More tool access means a larger blast radius.
Does isolation prevent exfiltration?
No, not by itself. Isolation moves page execution off the device. It does not limit connector scopes. You still need least privilege and approvals.
References
- 01OWASP LLM06:2025 Excessive AgencyOWASP Gen AI Security Project
- 02OWASP LLM01:2025 Prompt InjectionOWASP Gen AI Security Project
- 03Model Context Protocol: Security Best PracticesModel Context Protocol
- 04CVE-2025-32711: M365 Copilot Information Disclosure VulnerabilityMicrosoft Security Response Center
- 05OWASP Top 10 for Agentic Applications (December 9, 2025)OWASP Gen AI Security Project
Keep exploring
- Prompt injection: direct and indirect attacksHow hidden instructions steer a model.
- MCP server security: the config nobody readsWhat to check in MCP server setup.
- Indirect prompt injection targets browser agentsHidden instructions in pages that agents read.
- Install the skillAgent builders reach the same routing and isolation through a ready skill.
- All guidesThreats, secure apps, and AI security pages.
- All AI security guidesBrowse AI topics by risk type.
- Secure apps directorySecure browsing guides for top SaaS apps.
- Threat libraryThreat pages with checklists and FAQs.
