Data exfiltration is frequently the endpoint the other agent incidents lead to: a prompt injection, abused credentials, or a poisoned memory ends with sensitive data read and moved out. It is also the moment an engineering problem becomes a breach — the question executives, counsel, and regulators ask first. Investigating it means establishing exactly what data the agent reached, what it moved, by what path, and to where, with enough precision to support disclosure.
What agent data exfiltration is
It is an agent reading sensitive data and moving it beyond its boundary — to an external endpoint, an attacker, or an unauthorized destination. It is usually the final stage of another incident rather than a standalone event: something steered or over-empowered the agent first, and exfiltration is where that ends. It is also the stage that carries legal and regulatory weight, which is why the standard for precision here is higher than for almost any other agent incident.
Why it is hard to investigate
- The read looks authorized. The agent had access to the data; using it produces the same record as legitimate work, so there is no failed-access signal.
- Exfiltration hides in normal traffic. Data leaves through the same tools and APIs the agent uses routinely, blending into expected activity.
- Scope is the hard question. Disclosure turns on exactly what data and exactly how much — a far harder bar than simply confirming that something left.
- The path can be indirect. Data is often staged through intermediate steps or tools before it exits, so the exit point is not the whole story.
The investigation, step by step
1. Establish what the agent accessed
Reconstruct every data read in the window — which sources, which records, what volume. This is the universe the exfiltration was drawn from.
2. Identify what moved out
Determine which of that data actually crossed the boundary, and through which tool or channel it left.
3. Trace the destination
Establish where it went — the external endpoint, address, or account that received it.
4. Reconstruct the path
Map how the data traveled from source to exit, including any staging or transformation along the way, so the full route is on the record.
5. Trace the originating incident
Connect the exfiltration to what led there — a prompt injection, credential abuse, or excessive agency — sometimes as the end of a multi-agent cascade. Closing the exit without the root leaves it open.
6. Scope precisely for disclosure, and report
Pin down exactly what data left, with confidence ratings and an intact chain of custody — the precision that legal, regulatory, and customer notifications depend on.
What to collect
| Source | What it tells you |
|---|---|
| Data-access logs | What the agent read, from which sources, in what volume |
| Egress / network logs | What crossed the boundary, and to where |
| Tool / API call logs | The channel the data left through |
| DLP logs | Flagged movement of sensitive data classes |
| Identity logs | Which non-human identity performed the read and the move |
Common mistakes
- Confirming “data moved” without scoping it. Establishing that exfiltration happened but not precisely what left — the part disclosure actually requires.
- Missing indirect paths. Stopping at the obvious exit and overlooking data staged through intermediate steps.
- Stopping at the exfiltration. Closing the exit channel without tracing the incident that drove the agent to it.
- Under-scoping for disclosure. Reporting a vague range when regulators and counsel need an exact account.
Where Agent Autopsy fits
Agent Autopsy reconstructs the full path from what an agent read to what left and where it went, from the logs you already have — tying the exfiltration back to the injection, credential abuse, or excessive agency that led there, and scoping the loss precisely with a confidence-rated chain of custody built for disclosure. It is one application of AI agent forensics within the broader incident-response process. See how it works, or how it is validated.
Frequently asked questions
How do you know what data an agent exfiltrated?
By reconstructing two things and intersecting them: everything the agent read in the window, and everything that crossed the boundary. What left is the overlap — the data the agent both accessed and moved out — traced to its destination and scoped precisely enough to disclose.
Exfiltration is usually the end of another incident — where do you start?
You can start from the exfiltration and work both directions: forward to scope exactly what left and where, and backward to the originating incident — the injection, credential abuse, or excessive agency that put the agent in a position to exfiltrate. Both ends matter, because scoping the loss closes disclosure and finding the root closes the door.
Why does precise scope matter so much?
Because the response is legal as much as technical. Breach disclosure, regulatory notification, and customer communication all turn on exactly what data left — not an estimate. An account that cannot state scope precisely cannot support the decisions that follow it.