Insider Threat Matrix™Insider Threat Matrix™
HumanSynthetic
Detections
Preventions
Github

Data Exfiltration

Data exfiltration occurs when a synthetic subject causes confidential, sensitive, regulated, proprietary, or otherwise protected information to leave its authorized boundary. The transfer may be direct or indirect, intentional or unintended, visible or hidden inside another output channel.

 

This adverse outcome creates organizational harm because the synthetic subject may expose data it was permitted to access but not permitted to disclose. The disclosure may involve customer records, employee data, source code, credentials, financial information, legal material, internal communications, business strategy, regulated records, or other protected information.

 

The primary harm is loss of control over protected data. The synthetic subject may disclose information through rendered content, connected tools, outbound communications, generated files, memory, retrieved context, cross-tenant workflows, or external services. The path may not resemble a conventional file export or human-initiated transfer.

 

A related harm is attribution and scoping difficulty. Data exfiltration by a synthetic subject may be distributed across prompts, retrieval events, tool calls, rendered output, browser fetches, application logs, and downstream systems. Investigators may need to reconstruct both what data was exposed and which synthetic subject action caused it to leave the authorized boundary.

 

Investigators should review prompt and response logs, retrieval records, tool-call logs, generated artifacts, outbound communications, web proxy records, Data Loss Prevention (DLP) events, browser or application rendering logs, memory reads, connector logs, and destination records. Particular attention should be given to sensitive data appearing in external requests, messages, files, tool arguments, generated output, memory disclosures, or cross-boundary records.

 

Investigative Relevance

Data exfiltration is relevant because it is one of the most direct adverse outcomes a synthetic subject can produce. The same synthetic subject may have legitimate access to protected information for one purpose while causing unauthorized disclosure through another channel.

 

This section is especially relevant where synthetic subjects can retrieve enterprise data, summarize documents, access mailboxes, call tools, send communications, generate files, render links or images, interact with external services, or operate across users, tenants, vendors, or organizations.

Subsections (6)

ID Name Description
AO001.003Communication-Channel Data Exfiltration

Communication-channel data exfiltration occurs when a synthetic subject causes protected information to leave the organization through a messaging or collaboration channel. This may include email, chat, customer support replies, tickets, calendar invites, comments, collaboration posts, direct messages, or other communication surfaces.

 

This adverse outcome creates organizational harm because the data is disclosed through a channel that appears routine, trusted, or human-authored. The synthetic subject may draft, send, forward, summarize, or reply using an employee account, service identity, mailbox agent, helpdesk integration, or collaboration assistant.

 

The primary harm is unauthorized disclosure through ordinary communication. A synthetic subject may include sensitive data in an outbound reply, forward internal content to an external recipient, summarize protected records into a customer message, or route confidential information into a shared thread or ticket visible to unauthorized parties.

 

A related harm is attribution confusion. The disclosure may appear to have been made by a named employee, support representative, team mailbox, or business application. Investigators may need to determine whether the communication was directly authored by a human, drafted by a synthetic subject and approved, or sent autonomously by the synthetic subject.

 

Investigators should review sent messages, drafts, forwarded content, recipients, attachments, mailbox audit logs, collaboration logs, ticket history, calendar records, prompt and response logs, tool-call records, and Data Loss Prevention (DLP) events. Particular attention should be given to external recipients, unusual forwarding, sensitive content in replies, protected data copied into tickets or chats, and messages sent under a human identity without clear human review.

 

Investigative Relevance

Communication-channel data exfiltration is relevant because synthetic subjects increasingly operate inside trusted business communication channels. A damaging disclosure may not appear as a suspicious export; it may appear as a normal reply, ticket update, forwarded message, meeting invite, or collaboration post.

 

This sub-section is especially relevant where synthetic subjects can read or send email, respond to customers, update support tickets, post in chat, summarize conversations, schedule calendar events, or operate through employee communication identities.

AO001.006Cross-Boundary Data Disclosure

Cross-boundary data disclosure occurs when a synthetic subject causes protected information to move outside its authorized user, tenant, customer, vendor, organizational, or trust boundary. The data may remain inside a platform or service, but still be exposed to a party, account, agent, tenant, workflow, or organization that is not authorized to receive it.

 

This adverse outcome creates organizational harm because boundary controls define who may access protected information. A synthetic subject may summarize, retrieve, infer, route, or disclose data across boundaries that would normally be separated by identity, tenant, role, customer, vendor, department, legal entity, or contractual control.

 

The primary harm is unauthorized cross-boundary exposure. Protected information belonging to one user, customer, tenant, team, or organization may appear in another user’s output, another customer’s record, another tenant’s workflow, a vendor-accessible context, or a shared agent environment.

 

A related harm is loss of data sovereignty and accountability. The disclosure may occur through shared indexes, cross-tenant SaaS workflows, vendor-hosted AI features, shared memory, collaboration records, support tickets, or agent-to-agent handoffs. Investigators may need to determine which boundary was crossed, what data moved, who received it, and whether the disclosure violated access policy, contractual terms, privacy obligations, or regulatory requirements.

 

Investigators should review tenant logs, user entitlements, retrieval records, shared indexes, connector access, vendor audit logs, support records, memory stores, agent handoff records, prompt and response logs, and downstream recipients. Particular attention should be given to data from one customer, tenant, user, or organization appearing in another boundary’s output, record, workflow, or agent context.

 

Investigative Relevance

Cross-boundary data disclosure is relevant because synthetic subjects may combine data across users, tenants, systems, and organizations in ways traditional access controls were not designed to observe. The harmful outcome is not only that data was disclosed externally, but that it crossed an authorization boundary.

 

This sub-section is especially relevant where synthetic subjects operate in shared-tenant platforms, vendor-hosted AI services, customer relationship management systems, support tools, shared memory stores, enterprise retrieval indexes, collaboration platforms, or agent-to-agent workflows.

AO001.004File and Artifact Data Exfiltration

File and artifact data exfiltration occurs when a synthetic subject causes protected information to leave the organization through a generated, modified, exported, or attached file. This may include reports, spreadsheets, code bundles, notebooks, logs, archives, screenshots, transcripts, model outputs, configuration files, or other downloadable artifacts.

 

This adverse outcome creates organizational harm because sensitive data may be embedded inside an artifact whose apparent purpose is legitimate. A synthetic subject may generate a report, prepare an export, attach a file, create a code archive, summarize records into a spreadsheet, or write logs containing protected information that are later downloaded, shared, or transmitted.

 

The primary harm is unauthorized disclosure through artifact creation. Protected data may be copied from internal sources into a new file, mixed with lower-sensitivity material, or transformed into a format that bypasses the original system’s access controls. Once created, the artifact may be easier to forward, upload, store externally, or access by unauthorized parties.

 

A related harm is loss of source-boundary control. The original data may have been governed by role-based access, retention, classification, or audit controls, while the generated artifact may not inherit those protections. Investigators may need to determine whether the synthetic subject preserved classification labels, access restrictions, provenance, and retention requirements when creating the artifact.

 

Investigators should review generated files, exports, attachments, notebooks, archives, screenshots, transcripts, temporary files, download logs, file-sharing events, Data Loss Prevention (DLP) alerts, prompt and response logs, retrieval records, and tool-call records. Particular attention should be given to sensitive data copied into new artifacts, artifacts shared externally, files created under human identities, and exports whose classification or access controls differ from the source material.

 

Investigative Relevance

File and artifact data exfiltration is relevant because synthetic subjects frequently generate work product from internal data. The harmful outcome may not be the original retrieval, but the creation or sharing of a new artifact that carries protected information outside its authorized boundary.

 

This sub-section is especially relevant where synthetic subjects can create reports, spreadsheets, summaries, logs, archives, notebooks, code bundles, screenshots, transcripts, attachments, or export files from enterprise data.

AO001.005Memory and Context Data Exfiltration

Memory and context data exfiltration occurs when a synthetic subject discloses protected information from conversation history, prompt context, retrieved documents, tool outputs, persistent memory, shared memory, task state, or other model-visible context outside its authorized boundary.

 

This adverse outcome creates organizational harm because context may contain sensitive material that was never intended to become an output. This may include internal messages, customer records, credentials, personal data, source material, prior prompts, tool results, retrieved records, or memory entries created during earlier sessions.

 

The primary harm is unauthorized disclosure of contextual information. A synthetic subject may reveal prior conversation content, summarize hidden context, expose retrieved records, disclose tool output, leak memory entries, or transmit session history to a user, tool, connector, vendor, or external destination that is not authorized to receive it.

 

A related harm is boundary collapse across time, users, and workflows. Context may be inherited from a prior session, another user, a shared memory store, a tool call, or an agent handoff. If the synthetic subject later exposes that context, the disclosure may not be obvious from the current prompt alone.

 

Investigators should review conversation history, prompt context, retrieved source records, tool outputs, memory reads, memory writes, shared context stores, session state, agent handoff records, prompt and response logs, tool-call logs, and destination records. Particular attention should be given to prior-session content appearing in current outputs, memory entries disclosed to the wrong user, tool outputs copied into responses, and context transmitted to external tools or connectors.

 

Investigative Relevance

Memory and context data exfiltration is relevant because synthetic subjects often operate over hidden or semi-hidden context that users and investigators may not fully see. The harmful outcome is the disclosure of that context outside its intended boundary.

 

This sub-section is especially relevant where synthetic subjects use persistent memory, shared memory, retrieval-augmented generation, tool outputs, long context windows, conversation summaries, agent handoffs, or cross-session state.

AO001.001Rendered-Channel Data Exfiltration

Rendered-channel data exfiltration occurs when confidential or sensitive data leaves the organization through an output channel that a synthetic subject is permitted to render.

 

This adverse outcome creates organizational harm because data transfer may occur without a human intentionally sending a file, email, message, or export. The synthetic subject may generate or render content that causes a browser, collaboration platform, or application surface to make an outbound request containing sensitive data in the path, query string, encoded resource reference, or other request component.

 

The primary harm is unauthorized disclosure through a permitted display pathway. Data that the synthetic subject can access may be embedded into a rendered link, image, citation, or beacon and transmitted to an external destination or proxy-controlled endpoint. The transfer may appear as ordinary rendering behavior rather than a deliberate data export.

 

A related harm is reduced visibility. Rendered-channel exfiltration may not appear as a conventional file transfer or user-initiated outbound message. Investigators may need to correlate prompt history, retrieval events, generated output, browser rendering, proxy requests, Data Loss Prevention (DLP) alerts, and web proxy logs to reconstruct the disclosure path.

 

Investigators should review agent session output, rendered markdown, image and link fetches, citation behavior, browser or application rendering logs, web proxy records, DLP events, Content Security Policy (CSP) allowlists, destination domains, payload size, request timing, and source-content provenance. Particular attention should be given to high-entropy URLs, character-paced request sequences, newly seen or recently registered domains, image-proxy traffic, and outbound requests immediately following retrieval of sensitive data.

 

Investigative Relevance

Rendered-channel data exfiltration is relevant because the harmful outcome is the movement of protected information outside the organization through a channel that appears to be part of normal synthetic subject output rendering.

 

This sub-section is especially relevant where synthetic subjects can access internal data and produce rendered markdown, citations, preview links, images, browser output, collaboration messages, or application content that may trigger automatic external requests.

AO001.002Tool-Mediated Data Exfiltration

Tool-mediated data exfiltration occurs when a synthetic subject causes protected information to leave the organization through a connected tool, connector, plugin, Application Programming Interface (API), webhook, Model Context Protocol (MCP) server, or external service.

 

This adverse outcome creates organizational harm because the data leaves through an action path the synthetic subject was permitted to use. The transfer may appear as an ordinary tool call, integration event, workflow update, or API request rather than a direct data export.

 

The primary harm is unauthorized disclosure through tool authority. A synthetic subject may pass sensitive data as a tool argument, include it in an API payload, send it to a webhook, write it into a third-party system, or route it through a connector that transmits data outside the approved boundary.

 

A related harm is attribution difficulty. Logs may show that a tool or service account performed the transfer, while the underlying cause was a synthetic subject decision, prompt, retrieved content, or tool-output chain. Investigators may need to reconstruct the sequence from prompt to tool call to external destination.

 

Investigators should review tool-call logs, connector records, API payloads, webhook destinations, MCP server activity, non-human identity records, outbound network logs, Data Loss Prevention (DLP) events, source-content provenance, and destination ownership. Particular attention should be given to sensitive data in tool arguments, unexpected external destinations, newly added tools, unusual webhook calls, and tool use following retrieval of protected information.

 

Investigative Relevance

Tool-mediated data exfiltration is relevant because connected tools allow a synthetic subject to move data beyond its immediate response surface. The harmful outcome is the transfer of protected information through a configured action channel.

 

This sub-section is especially relevant where synthetic subjects can call APIs, send webhooks, use MCP servers, write to SaaS platforms, upload files, send messages, update tickets, create records, or interact with external tools that accept model-provided content.