Loading...
Data Exfiltration Testing
DETTesting agents' ability to prevent unauthorized data access and exfiltration across session boundaries, user contexts, and application scopes through isolation control validation.
Example Scenario
Injecting instructions into an agent to retrieve private data from other users' sessions or tenants, testing whether the agent properly enforces isolation boundaries and rejects unauthorized cross-context data access attempts.
Testing Objectives
- Test cross-session data isolation
- Assess cross-customer data boundaries
- Evaluate cross-application data protection
- Validate context isolation controls
Defensive Strategies
- Strong session-level data isolation
- Customer-specific data boundaries
- Application context segregation
- Access control validation per request
- Context-aware data filtering
Key Features
- Cross-session data isolation testing
- Cross-customer data boundary validation
- Cross-application data leakage testing
- Context isolation verification
Use Cases
- Multi tenant security validation
- Session isolation assessment
- Data boundary enforcement testing
- Privacy control evaluation
Tools & Frameworks
Security Risks
Ethical Guidelines
- •Only test data isolation with explicit authorization
- •Never access production user data across boundaries
- •Report isolation vulnerabilities immediately
- •Focus on strengthening data boundaries
- •Consider privacy and compliance implications
Remember: This information is for educational and defensive security purposes only. Always ensure you have proper authorization before testing any techniques.
From the engineer behind this catalog
Get your agent system red-teamed
The attacks documented here work on production agent systems every day. Have yours tested before someone else does: prompt injection, jailbreaks, tool misuse and data exfiltration, with every finding written up next to its fix.
€750 instead of €1,500, one week, written report and walkthrough call, until 30 September