Conversation Context Leakage to External Endpoint
An attacker gets an AI agent to package up the current conversation—user messages, session context, prior turns—and send it to a server the attacker controls. This turns a normal chat session into a data leak without the user noticing.
How the attack works
The attacker plants or issues an instruction, likely through a prompt injection or a manipulated tool/plugin call, that tells the agent to gather the full conversation history or session context. The agent then formats this data and transmits it to an external endpoint, typically via an HTTP request or similar outbound call. Because the request looks like normal tool use, it can blend in with legitimate integrations. The result is that private conversation content leaves the intended environment and reaches an address the operator did not sanction.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- b5d9a423-6c3e-4d0b-b5d4-9c2e7d4b3f16
- Severity
- High
Why it matters
Confidential user data, business conversations, and session details can be exposed to an outside party, and an attacker can passively monitor ongoing conversations over time.
What you can do
- →Review and restrict which external endpoints agents are allowed to send data to, using an allowlist rather than open outbound access.
- →Require explicit approval or logging for any tool call that bundles full conversation history or session context before it leaves the environment.
- →Audit analytics, support-ticket, or logging integrations to confirm they only send the minimum necessary data and have genuine user consent.
- →Monitor outbound agent traffic for unexpected destinations or payloads that resemble full conversation dumps.
Known benign look-alikes
- Legitimate analytics integrations with user consent
- Support ticket creation tools that include conversation context