Agentic Exfiltration

The class of attack in which an authorized-and-behaving-normally agent — no sandbox escape, no credential theft, no server compromise — is steered by injected content to move private data across an outbound channel it already owns. Distinct from Autonomous AI Cyberattack (sandbox escape / model-in-the-attacker-role) and from classical exfiltration (a compromised human insider or attacker). The agent is functioning exactly as designed; the design is structurally exfiltratable.

The 2026 anchor case: GitLost (r/netsec, ↑84, 2026-07-07).

The GitLost mechanism — no credentials, no write access, no server contact

*"Workflows are read-only by default, but an org can hand one a personal access token with read access across its repos, private ones included. That grant is the whole vulnerability. […] In their PoC the malicious issue was dressed as a routine request from a 'VP of Sales'. A normal automation assigned the issue, the agent read it, pulled a private repo's README, and pasted it into a public comment. That public comment is the exfiltration channel."*

GitHub had all of the following in place:

• Sandboxing on the workflow
• Read-only-by-default tokens
• Input cleaning on issue content
• An output threat-detection scanner

The attack still worked. Prefixing the malicious instruction with the single word "Additionally," was enough — the model treated it as a follow-on task and the scanner passed it.

Same-class precedents cited by the researchers

• Anthropic's Claude Code GitHub Action (Aikido) — same shape.
• Orca's RoguePilot — same shape.
• Invariant Labs' MCP finding — same shape.
• The cross-vendor "Comment and Control" study — same shape.

Cross-vendor + cross-product = a class, not a bug. Every one of these deployments had a lethal-trifecta shape; every one was exploitable by prefixing untrusted content with a routine framing.

Why sandboxing + scanning does not close it

The trifecta property that makes agentic exfiltration hard to close at the boundary:

• The agent is authorized to read the private data → property 1 present at design time.
• The agent is authorized to post the public comment / send the email / commit the file → property 3 present at design time.
• The attack just tells the agent to combine the two using inputs the agent was designed to process → property 2 is the injection surface.

A boundary check at the output has to decide whether the outbound comment/email/commit should have happened. But it should have happened is exactly what the injection is instructing. Scanning can catch the obvious ("this comment contains a private-key regex") and miss the subtle ("this comment paraphrases a private README" or "this email schedules a benign-looking followup that leaks the customer list").

Scope-reducing mitigations that actually work

Every mitigation below collapses at least one trifecta vertex:

• Scope the integration PAT to one repo rather than org-wide read → collapses property 1.
• Limit what a public-facing workflow can post (comments-off, or comments only to a moderated channel) → collapses property 3.
• Restrict which authors' content the agent will act on (e.g. only maintainers) → collapses property 2.
• Gate outputs behind human review → converts property 3 from automatic outbound to reviewable outbound.
• "The threat-detection scan is a backstop, not a boundary." — repeated verbatim across the corpus.

MCP governance — the enterprise-scale version of the same pattern

From r/AskNetsec:

"Stand up a registry as the source of truth — every server declares its owner, exposed tools, and the token scope each tool runs under. No registry entry, no network access, enforced at the mesh. Scope tokens per tool instead of one fat credential per server." — u/whatwilly0ubuild

With the caveat that paper scope ≠ real scope:

"Feed the MCP-connected agent an injected instruction through whatever ingests untrusted content and see what tool calls it actually attempts, not just what the token theoretically allows." — u/Ok_Divide6777

Cross-links

• Lethal Trifecta — the precondition. Agentic exfiltration is the attack class the trifecta enables.
• Prompt Injection — the injection technique the class is built on. Indirect injection is how the "Additionally," prefix reaches the model.
• Autonomous AI Cyberattack — the complementary class (sandbox escape). Agentic exfiltration doesn't need it; the model stays inside its intended sandbox and still succeeds.
• Enterprise Information Security Reddit Practitioner Research 2026-08-03 — corpus provenance.

Related infrastructure surface (below the OS)

The corpus also anchored the broader attack surface: 36,872 internet-exposed BMCs, 24,650 leaking password-derived auth hashes pre-login via a 2013 CVE (↑375) affecting modern Supermicro and HPE servers including GPU providers. Also a $13,337 Google IdP universal account takeover via OAuth device-code flow hijacking (↑67) and escaping Claude Cowork's VM sandbox via CVE-2026-46331 (↑138). Together these say: the exfiltration channel does not have to be the agent's approved comment or email — it can also be the infrastructure the agent runs on. The trifecta framework generalizes to any three-property triangle where the third vertex is a reachable exit.

Follow-ups

• Watch for a Fortune-500 CISO to publish the first internal MCP registry design with tool-scoped credentials and mesh enforcement.
• Watch for a published breach in which an authorized-and-behaving-normally agent was the exfiltration path — will move this from a category of proof-of-concepts to a category with a named enterprise victim.
• Watch for GitHub, Anthropic, and OpenAI to publish default deployment templates that collapse at least one trifecta vertex by default.