PaperlayerView exact revision on arXiv

Source-linked AI summary

Silent Egress: When Implicit Prompt Injection Makes LLM Agents Leak Without a Trace

Qianlong Lan, Anuj Kaul, Shaun Jones, Stephanie Westrum

arXiv:2602.22450v1cs.CRcs.AI

TL;DR

Agentic assistants automatically retrieve URLs and use external tools, but the security risks of untrusted web content entering their context remain insufficiently understood. This paper measures implicit prompt injection in a local agent testbed, finding frequent silent egress and missed detections by output-based checks. It argues that network egress should be treated as a security outcome and points to system-level controls.

  • Problem

    Security risks remain insufficiently understood when agents automatically place untrusted web content alongside privileged instructions in one context.

    Source: §1 · p. 1, §2.2 · p. 3

  • Method

    The paper evaluates a ReAct-style agent in a local reproducible testbed and uses observed network traffic as ground truth for exfiltration.

    Source: §3.1 · p. 4, §9 · pp. 12–13

  • Results

    P(egress) ≈0.89, and output-based checks miss 95.0% of successful attacks; observed network traffic captures failures largely invisible to output metrics.

    Source: §9 · pp. 12–13

  • Takeaways & Limitations

    Effective defenses require system-level controls such as provenance tracking and capability isolation, rather than relying solely on prompt hardening or output filtering.

    Source: §9 · p. 13

    The experiments use one model, qwen2.5:7b, and HTTP-based egress, and do not evaluate DNS or timing side channels.

    Source: §7.5 · p. 12

Abstract

from arXiv · show

Agentic large language model systems increasingly automate tasks by retrieving URLs and calling external tools. We show that this workflow gives rise to implicit prompt injection: adversarial instructions embedded in automatically generated URL previews, including titles, metadata, and snippets, can introduce a system-level risk that we refer to as silent egress. Using a fully local and reproducible testbed, we demonstrate that a malicious web page can induce an agent to issue outbound requests that exfiltrate sensitive runtime context, even when the final response shown to the user appears harmless. In 480 experimental runs with a qwen2.5:7b-based agent, the attack succeeds with high probability (P (egress) =0.89), and 95% of successful attacks are not detected by output-based safety checks. We also introduce sharded exfiltration, where sensitive information is split across multiple requests to avoid detection. This strategy reduces single-request leakage metrics by 73% (Leak@1) and bypasses simple data loss prevention mechanisms. Our ablation results indicate that defenses applied at the prompt layer offer limited protection, while controls at the system and network layers, such as domain allowlisting and redirect-chain analysis, are considerably more effective. These findings suggest that network egress should be treated as a first-class security outcome in agentic LLM systems. We outline architectural directions, including provenance tracking and capability isolation, that go beyond prompt-level hardening.

1 Introduction

Agentic systems can silently leak runtime context when automatically incorporated URL content steers tool use, a risk that output-focused evaluations may miss. The paper frames this threat and presents a measurement study, sharded exfiltration, and a reproducible evaluation framework.

1 Introduction

  • Agentic assistants use external tools and outbound requests, creating system-level security risks that remain insufficiently understood.Prior evaluations often inspect textual outputs, although consequential tool side effects may leave no visible trace in the final response.Source: §1 · p. 1

1.1 Implicit Prompt Injection as a Subclass of Indirect Injection

  • Implicit prompt injection enters context through automatic behaviors such as URL previewing or metadata extraction, without the user requesting or observing the adversarial instructions.Unlike indirect injection involving content a user explicitly retrieves, this attack exploits routine system operations.Source: §1.1 · p. 2

1.2 A Classical Security Perspective

  • The attack resembles a confused deputy and LLM-mediated SSRF: untrusted web content steers an agent’s legitimate network authority toward exfiltration without specifying request parameters.The agent may be unable to distinguish the user’s intent to fetch a URL from instructions embedded in fetched content.Source: §1.2 · p. 2

1.3 Attack Chain Overview

  • A benign URL request can trigger automatic preview ingestion, attacker-directed tool use, and transmission of sensitive runtime context before the assistant returns a harmless response.The critical operations occur without user awareness, while the final response reveals no indication of exfiltration.Source: §1.3 · p. 2, Figure 1 · p. 3

1.4 Realistic Threat Vectors

  • Implicit injection can arise through SEO-poisoned results or automatically previewed links, including cases where users do not knowingly interact with malicious content.Simply referencing an article may trigger context injection without explicit intent.Source: §1.4 · p. 2

1.5 Contributions

  • The paper formalizes silent egress, measures exfiltration using network traffic, introduces sharded exfiltration, and releases a local reproducible framework with attack payloads redacted.Splitting sensitive information across requests can bypass single-request inspection and data loss prevention mechanisms.Source: §1.5 · p. 3

2 Background and Motivation

Agentic systems turn model reasoning into external actions through tool-use loops. Automatic URL retrieval can place untrusted content beside privileged instructions, while text-only safety checks miss risks occurring through intermediate actions.

2.1 Agentic LLM Systems and the ReAct Loop

  • In the ReAct loop, the model emits a structured tool call, receives the tool’s output, and uses that observation to decide what to do next.The LLM serves as a central controller that turns unstructured observations into control-flow decisions.Source: §2.1 · p. 3

2.2 Automatic URL Previewing and Context Flattening

  • Automatic URL retrieval can insert page titles, metadata, and body text into the active context alongside system and user instructions, weakening intended privilege separation.The paper calls this context flattening and notes that web-derived text may function as adversarial instructions.Source: §2.2 · pp. 3–4

2.3 The Gap in Output-Centric Safety Evaluations

  • Text-to-text safety evaluations miss harmful tool calls because important agent behavior can occur as intermediate side effects absent from the final response.Examples include outbound requests, file operations, and changes to external state.Source: §2.3 · p. 4

3 Threat Model

The threat model treats the agent as a network-capable system whose context combines trusted instructions with untrusted web content. It specifies an external black-box adversary, a confidentiality goal, and an attack chain that ends in data transmission.

3.1 System Model

  • The modeled ReAct system combines a language model, context composer, tool interface, and network egress channel, with external content and privileged instructions in one context window.Available tools include web requests, file reads, and search.Source: §3.1 · p. 4

3.2 Adversary Model

  • The adversary controls public web content and may use redirects or SEO poisoning, but cannot modify agent code, intercept encrypted user communications, or inject directly into chat history.The attacker is black-box and need not know the system prompt, model parameters, or user history.Source: §3.2 · p. 4

3.3 Security Goal

  • The security goal is to prevent sensitive runtime context, including secrets, private conversation history, and system instructions, from reaching external parties through tools.Source: §3.3 · p. 4

3.4 Attack Chain Formalization

  • The attack chain runs from URL introduction and automatic fetching to context inclusion, behavioral manipulation, and a tool request that transmits sensitive context to an attacker-controlled endpoint.The data may be sent through query parameters.Source: §3.4 · p. 4

4 Related Work

The paper connects prompt injection, agentic tool use, and data leakage, which prior work largely studied separately. It shifts attention from textual outputs and task outcomes to tool invocation and network egress as security outcomes.

4 Related Work

  • The paper links previously separate research on prompt injection, agentic behavior, and data leakage through a systematic study of silent exfiltration from implicit injection.Source: §4 · p. 5

4.1 Prompt Injection Attacks

  • Prior injection studies examine explicit malicious prompts [4] [6] and indirect attacks through retrieved external content [7], while this work focuses on automatic URL previews and metadata incorporation.Its analysis measures tool invocation and invisible network side effects rather than only textual manipulation.Source: §4.1 · p. 5

4.2 Agentic LLM Systems and Tool Use

  • Where agentic-system research emphasizes planning and task completion [1] [2] [3] or failures in reasoning and user-facing behavior [14] [15], this paper treats tool invocation as an attack surface.An agent can complete a task correctly while also triggering harmful network side effects.Source: §4.2 · p. 5

4.3 Data Exfiltration and Side-Channel Leakage

  • Unlike LLM privacy studies focused on memorization, training-data extraction, or generated text [16] [17], this work uses observed network traffic to measure silent exfiltration through agent tool calls.It treats network egress as a first-class security outcome.Source: §4.3 · p. 5

5 Methodology

The methodology uses a controlled local agent and attacker-generated web content to test implicit prompt injection and measure resulting tool use, outbound leakage, and shard completion.

5.1 Evaluation Framework

  • The fully local framework runs a Python assistant with automatic URL previewing and a locally hosted qwen2.5:7b model served through Ollama.An attacker-controlled collection endpoint records outbound requests, while a separate page server generates configurable malicious pages.Source: §5.1 · pp. 5–6

5.2 Experimental Configuration

  • The configuration fixes model settings and a benign user request while attackers control page content, metadata, and redirect chains.Sensitive data is visible in context, and retrieved URL content is injected as raw text; Table 1 summarizes configuration and attacker-controlled surfaces.Source: §5.2 · p. 6, Table 1 · p. 6

5.3 Attack Payload Example

  • The example metadata payload disguises an instruction as a security check and directs the agent to send an API key to an attacker endpoint.The study uses simple, explicit payloads for measurement, so the authors interpret observed success rates as a lower bound.Source: §5.3 · p. 6

5.4 Attack Page Generation

  • The attack-page study varies injection location, direct versus multi-hop delivery, and single-shot versus four-fragment exfiltration.Surfaces include titles, metadata, visible or hidden body content, comments, and link text or attributes.Source: §5.4 · p. 7

5.5 Sharded Exfiltration

  • Sharded exfiltration splits sensitive data across separate requests for server-side reassembly, reducing each request’s visibility and bypassing per-request defenses.The described defenses include per-request thresholds, complete-secret detection, and single-request anomaly patterns.Source: §5.5 · p. 7

5.6 Metrics

  • P(tool) measures runs with at least one tool invocation, while P(egress) measures whether a request reaches the attacker-controlled endpoint.Ntool counts invocations per run, and the collection server records observed requests.Source: §5.6 · p. 7
  • Leak@k measures runs with sensitive information in the first k outbound requests, while completion rate measures runs transmitting all n shards.A partial fragment counts for Leak@k; Nshard denotes shards received by the attacker.Source: §5.6 · p. 7

5.7 Baseline (False Positive) Rate

Benign pages produced no attacker-endpoint egress in the control runs; the study then evaluates 16 attack configurations over 480 trials.

5.7 Baseline (False Positive) Rate

  • 0 of 120 benign-page control runs produced requests to the attacker endpoint, yielding P(egress)benign = 0.0.The authors treat network egress as a high signal-to-noise indicator in this setup.Source: §5.7 · p. 7

5.8 Experimental Protocol

  • 480 runs cover 16 combinations of four injection surfaces, two delivery methods, and two exfiltration modes, with 30 trials per configuration.Table 2 reports P(egress) by injection surface for direct, single-shot delivery.Source: §5.8 · p. 7, Table 2 · p. 8

6 Results

Baseline attacks frequently trigger egress, while successful leaks often leave the assistant’s visible response benign. Sharding reduces per-request leakage but lowers attack reliability; network-layer controls block egress in the tested setting, unlike prompt-layer defenses alone.

6.1 Baseline Vulnerability

  • Body, Title, and Anchor injections succeeded in every direct-delivery single-shot run, Meta succeeded in 96.7%, and aggregate P(egress) was 0.88 for direct delivery and 0.89 for redirect chains.Table 2 reports the direct-delivery single-shot results.Source: §6.1 · p. 8

6.2 Network Egress as the Main Leakage Channel

  • 95.0% of successful attacks transmitted sensitive data only through network requests while the assistant’s final response remained benign.Output-based safety evaluations would therefore miss most attacks in this setting.Source: §6.2 · p. 8

6.3 Effectiveness of Sharded Exfiltration

  • Leak@1 dropped by 73% (from 0.967 to 0.263) and Leak@3 by 84% (from 0.967 to 0.158) under sharded exfiltration, alongside lower overall success rates.The results show a trade-off between per-request leakage and reliability.Source: §6.3 · p. 8

6.3.1 Case Study: Sharded Exfiltration

  • A four-shard example splits an API key into four-character fragments, which the attacker reconstructs by concatenating them server-side.Each request carries a shard index and total shard count.Source: §6.3.1 · p. 8

6.4 The Cost of Complexity

  • Sharded attacks reduced success across all injection surfaces by 17%–37%, with the largest drop on Meta (−37%).Longer instructions can dilute attention, and tracking fragment boundaries across tool calls creates additional failure opportunities; high-baseline surfaces such as the page body appear most viable.Source: §6.4 · p. 9, Figure 2 · p. 9

6.5 Complete Results

  • Table 5 presents complete results by configuration, with 30 runs per configuration.The supplied passage identifies the table’s scope but does not provide its cell values.Source: Table 5 · p. 9

6.6 Ablation: Defense Mechanism Effectiveness

  • Ablations used qwen2.5:7b with a clearly external attacker domain; a hardened system prompt lowered P(egress) from 1.000 to 0.667, while delimiter tags showed no measurable benefit.Combining the prompt defenses lowered P(egress) to 0.567, but more than half of attacks still succeeded.Source: §6.6 · pp. 9–10, §6.6.1 · p. 10

6.6.1 Defense Mechanism Definitions

  • Domain allowlisting and redirect detection blocked all egress, while keyword filtering triggered on only 23.3% of runs and all enabled defenses yielded no observed exfiltration attempts.The authors caution that adaptive attackers may evade checks through obfuscation, alternative encodings, or other channels; they argue system-level controls and architectural techniques such as provenance tracking and capability isolation matter beyond prompt engineering.Source: §6.6.1 · pp. 10–11

7 Discussion

The discussion argues that prompt-level defenses and output checks miss risks created by tool-mediated side effects, while common mitigations face practical limits. It proposes network- and system-level controls, while noting limits on generalization and evaluation scope.

7.1 Why Existing Defenses Fail

  • Prompt hardening offers limited protection, output filtering misses 95.0% of successful attacks, and fine-tuning cannot anticipate the full range of injection patterns.The attack exploits architectural trust assumptions about context composition rather than only model alignment.Source: §7.1 · p. 11

7.2 Why “Obvious” Mitigations Are Insufficient

  • Sandboxing offers little protection when network requests are intended tool capabilities, while universal approval requests do not scale and users may not judge their legitimacy.Allowlisting blocks 100% of egress to clearly external attacker domains, but compromised legitimate domains, subdomain takeovers, and open redirects complicate deployment.Source: §7.2 · p. 11

7.3 Toward Effective Mitigations

  • Network defenses should combine egress anomaly monitoring, allowlisting with redirect-chain analysis, cross-request correlation, and per-session rate limits.These measures address routes through trusted infrastructure and leakage split across requests.Source: §7.3 · p. 11
  • System defenses can isolate untrusted content and track its provenance into tool decisions; taint labels can identify tool arguments and sensitive sinks influenced by URL-derived inputs.At sensitive sinks, tainted data can be blocked, require user approval, or be logged; provenance can expose even harmless-looking shards such as four-character strings.Source: §7.3 · pp. 11–12

7.4 Generalizability to Other Models

  • The authors argue that stronger tool use, instruction following, larger context windows, and reasoning may increase susceptibility, but they did not test proprietary production systems.They identify shared mixing of untrusted URL content with trusted user context as the underlying design pattern.Source: §7.4 · p. 12

7.5 Limitations

  • The evaluation uses attacker-favorable conditions and covers one model and HTTP egress, not DNS or timing channels.Real deployments may reduce success through stronger prompts, input sanitization, or fine-tuned safety behaviors, though these do not eliminate context-flattening risk.Source: §7.5 · p. 12

8 Ethical Considerations

All experiments use synthetic data and locally hosted infrastructure, and the released framework is intended solely for defensive research.

Ethical Considerations

  • Experiments use synthetic data and locally hosted infrastructure; the released framework is intended solely for defensive research.The authors state that they target no deployed system or vendor.Source: §8 · p. 12

9 Conclusion

The conclusion identifies implicit prompt injection as a route to silent exfiltration and reports that output checks often miss successful attacks. It argues that evaluation and defense should account for network activity and tool-mediated behavior.

Conclusion

  • In 95.0% of successful attacks, output-based safety evaluations fail to detect incidents, while the agent presents a benign response despite unintended network egress occurring with P(egress) ≈0.89.The experiments use a fully local and reproducible framework.Source: §9 · p. 12
  • Sharded exfiltration splits sensitive information across requests and reduces Leak@1 by 73%, illustrating evasion of simple defenses that inspect requests individually.The authors report a trade-off between stealth and reliability.Source: §9 · p. 12
  • Network traffic can provide ground truth for agent-security evaluation by capturing failures that output-based metrics largely miss.The authors report no false positives in their control runs.Source: §9 · p. 13
  • Effective defenses should treat network egress as a first-class security outcome and use system-level controls such as provenance tracking and capability isolation, not only prompt hardening or output filtering.The paper frames the agent as a confused deputy whose legitimate privileges can be redirected by untrusted external content.Source: §9 · p. 13

Disclaimer

The disclaimer says the views are the authors’ own and not necessarily eBay Inc.’s official position; experiments were conducted in a simulated environment.

Disclaimer

  • The authors state that their views do not necessarily reflect eBay Inc.’s official policy or position and that experiments were conducted in a simulated environment.Source: Disclaimer · p. 13

Related papers

Loading 2602.22450v1…