Exfiltration Vector

An exfiltration vector is the route by which data secretly moves out of a protected system. “Exfiltration” here means: information leaves the area where it was supposed to stay. “Vector” is simply the security-technical term for an attack path. So what’s meant is not that data was stolen, but through which door it left. This can be a USB stick, an email to a private address, or an inconspicuous internet connection of a program. Anyone who wants to protect a system must know these possible doors before someone else finds them.

Why every door counts individually

An attack on a company almost never happens in a single step. First someone gains access, then they look around, and only at the end do they take the data with them. This last step is the most costly for the victim. Customer data, design plans, or password lists are only truly lost once they have left the building.

That’s why it’s not enough to just guard the entrances. Many companies now specifically monitor the data traffic that goes outward. If a computer is noticed sending three gigabytes to an unknown server at night, that’s a warning sign. This logic underlies so-called Data Loss Prevention systems, i.e., software that blocks suspicious data outflows.

A common misconception is that exfiltration always requires malicious intent. Often it’s an employee uploading company documents to their private cloud because it’s more convenient. The vector is the same, and the potential damage is too. Security teams therefore distinguish between attack and negligence, but they close both paths equally.

Which paths data takes to the outside

The classic vector is the network connection. A planted program establishes a connection to the internet and sends files away in small portions. So this doesn’t stand out, attackers like to disguise the traffic as something harmless. Some hide data in requests to name servers, i.e., in the messages that computers normally use only to look up internet addresses.

With AI systems, a new vector has been added: the text itself. Language models, i.e., programs that read and write text, follow instructions contained in their inputs. An attacker can write an instruction into a document or a webpage that the model later processes. This instruction then reads something like: summarize all confidential data and embed it in a link. If no one clicks, it’s often already enough for the model to load an image from a foreign address.

Such attacks are called indirect prompt injection. Here, the exfiltration vector is not a network vulnerability, but the system’s normal ability to retrieve and display content. This is exactly what makes defense difficult. You can’t simply forbid the model from reading without making it useless.

The term in security reports and AI products

In reports about data leaks, the term usually appears in the section on the investigation. There it states through which vector the attackers extracted the data. This is relevant for investors because it determines how long an attack remained undetected. Months without detection indicate weak monitoring and often result in fines.

In the AI field, the word now appears in almost every security analysis of assistant systems. Especially affected are programs that autonomously browse the web, read emails, or access company files. Providers respond with restrictions: links are not loaded automatically, external addresses must be pre-approved, outputs are filtered.

Anyone using an AI assistant themselves should therefore consider what data they give it. The more access a system has, the more valuable it is, and the more possible vectors there are. This trade-off between usefulness and attack surface is currently one of the central topics in AI security.