数据外带路径Data Exfiltration Paths
Data Exfiltration Paths
把你的资料能离开机器的几条实际路线列出来，知道关掉哪一条最省事。List the concrete routes by which your material can leave your machine or your tenant, so you know which one is cheapest to close.
外带指内容被送到你没打算发送的地方。Agent 场景里的路线不止一条：模型发起的网络请求、工具调用的参数、写进文件的内容、图片 URL 的查询串。
最常见的一套组合是「读到不可信内容 + 能发请求」。网页或文档里藏一段指令，让模型把已经读到的东西拼进一个网址发出去。OWASP 把提示注入列为 LLM01、把敏感信息泄露列为 LLM06，说的就是这两步。
带网络能力的 server 还会碰到内网。MCP 官方安全实践把 SSRF、令牌透传、confused deputy 单独列出；本站抓取 server 的页面直接写了它能访问本地与内网 IP 地址。
你的数据实际走了多远，取决于给了哪些工具、哪些凭据、开了哪些目录。各家没有公布统一的泄露率数字，这件事只能在自己的权限配置上判断。
Exfiltration means content ends up somewhere you never intended to send it. In agent setups the routes are numerous: network requests the model initiates, arguments passed to tools, content written into files, secrets tucked into a URL query string.
The usual pairing is untrusted content plus an outbound channel. A page or document carries a hidden instruction telling the model to paste what it already read into a web address and fetch it. OWASP lists prompt injection as LLM01 and sensitive information disclosure as LLM06, which are exactly these two steps.
Servers with network reach also touch private space. The MCP security best-practices document singles out SSRF, token passthrough and the confused-deputy problem, and our own fetch-server page states plainly that it can reach local and internal IP addresses.
How far your data actually travels depends on which tools, credentials and directories you enabled. No vendor publishes a general exfiltration rate, so this is a question you answer about your own permission setup.
决定要不要让 AI 读某份材料，其实是在决定要不要多开一条出口。路线列清楚以后，你会发现通常只需要收掉两处：网络出口和凭据作用域。Deciding whether an AI may read a piece of material is really deciding whether you are opening another exit. Once the routes are on the table you usually find only two things worth closing: the outbound network path and the scope of the credentials.