Stopping Data Exfiltration Through LLM Prompts And Responses

Data exfiltration occurs when sensitive information leaves an organization without authorization, often without anyone realizing it has happened. With a large language model (LLM), this can happen in three ways: through a prompt someone types in, the model’s response or an action taken by an AI agent. Stopping exfiltration means addressing all three, rather than treating them as a single problem.

How Data Leaves Through The Prompt

This is the simplest and most direct way data leaves. For example, if an employee pastes a client contract into a chatbot to get a quick summary, that contract’s contents have already left the company’s control, regardless of what the chatbot does with them next. No malicious intent is needed, and the data leaves the moment it is typed in. This is the starting point for prompt AI security, since it focuses on what enters the model before it has a chance to respond.

How Data Leaves Through The Response

Sometimes the risk is not what an employee types in, but what the AI sends back. If a model has been trained on, or given access to, internal company documents, even an innocent question can lead it to reveal parts of that content in its response. In this case, the sensitive information comes from the AI’s access to data itself, not from anything the employee entered.

How Data Leaves Through Agent Actions

The third way involves AI agents, which can carry out tasks on a person’s behalf, such as sending an email or uploading a file. If someone tricks an agent with a misleading instruction, whether entered directly or hidden inside a document the agent reads, it can carry out that instruction without anyone reviewing it first. In this case, the data does not leave through text at all. It leaves through the action the agent takes.

This reflects the same least-privilege principle at the core of Zero Trust. An instruction should never be treated as safe just because it reached the agent.

Exfiltration Paths, Examples And Controls

The table below sets out each of these three paths, a real-world example of how it plays out and the specific control that stops it.

Each control sits at the point where the data is most at risk. Prompt monitoring catches sensitive information before it reaches the AI, response scanning catches it before it reaches the employee and limiting what an agent can do prevents it from acting on a bad instruction in the first place.

None of these three paths need to pass through a company’s usual network security, since a prompt, a response and an agent’s action can each happen entirely inside a browser tab or AI app. That is why visibility at the device level is what actually confirms whether data has left the company. Network security alone may not provide this visibility, because the activity can bypass traditional network controls. This reflects the same detection principle behind effective shadow AI management.