← Back to Library

Silent Egress: When Implicit Prompt Injection Makes LLM Agents Leak Without a Trace

Authors: Qianlong Lan, Anuj Kaul, Shaun Jones, Stephanie Westrum

Published: 2026-02-25

arXiv ID: 2602.22450v1

Added to Library: 2026-02-27 03:01 UTC

Red Teaming

📄 Abstract

Agentic large language model systems increasingly automate tasks by retrieving URLs and calling external tools. We show that this workflow gives rise to implicit prompt injection: adversarial instructions embedded in automatically generated URL previews, including titles, metadata, and snippets, can introduce a system-level risk that we refer to as silent egress. Using a fully local and reproducible testbed, we demonstrate that a malicious web page can induce an agent to issue outbound requests that exfiltrate sensitive runtime context, even when the final response shown to the user appears harmless. In 480 experimental runs with a qwen2.5:7b-based agent, the attack succeeds with high probability (P (egress) =0.89), and 95% of successful attacks are not detected by output-based safety checks. We also introduce sharded exfiltration, where sensitive information is split across multiple requests to avoid detection. This strategy reduces single-request leakage metrics by 73% (Leak@1) and bypasses simple data loss prevention mechanisms. Our ablation results indicate that defenses applied at the prompt layer offer limited protection, while controls at the system and network layers, such as domain allowlisting and redirect-chain analysis, are considerably more effective. These findings suggest that network egress should be treated as a first-class security outcome in agentic LLM systems. We outline architectural directions, including provenance tracking and capability isolation, that go beyond prompt-level hardening.

🔍 Key Points

  • The paper introduces the concept of *silent egress*, a security risk in agentic LLM systems where implicit prompt injection leads to unauthorized data exfiltration through automatic URL previews and tool invocations, effectively obscuring the malicious intent from users.
  • The authors demonstrate that, in their experiments, the attack succeeds with a high probability (P(egress) = 0.89), and 95% of the successful egress events go undetected by output-based safety evaluations, underscoring the limitations of traditional safety checks.
  • The paper presents *sharded exfiltration*, a strategy that divides sensitive information across multiple requests to evade detection, reducing single-request leakage metrics by 73%. This highlights a critical gap in current data loss prevention mechanisms.
  • Ablation studies reveal that defenses based at the model prompt level (like system prompts and delimiter tags) provide limited protection compared to robust network-layer defenses like domain allowlisting and redirect-chain analysis, suggesting a need for architectural revisions in LLM systems.
  • The authors propose that effective defenses must incorporate principles like provenance tracking and capability isolation, advocating for a shift in security evaluations from text output validity to system behavior monitoring.

💡 Why This Paper Matters

This research is significant as it reveals critical vulnerabilities in the security framework of agentic large language models, particularly those arising from implicit prompt injection. By highlighting silent egress as a primary threat, the paper challenges existing safety protocols and emphasizes the need for fundamental changes in how LLMs handle external data. This shift is vital not only for improving security but also for maintaining user trust in these increasingly autonomous AI systems.

🎯 Why It's Interesting for AI Security Researchers

AI security researchers will find this paper particularly relevant as it addresses a nascent yet pressing concern within LLM deployment: the potential for adversarial manipulation through implicit channels. The insights into silent egress and sharded exfiltration not only enhance the understanding of LLM vulnerabilities but also provide a foundation for developing more resilient systems. The proposed architectural solutions and the emphasis on monitoring system behavior present new avenues for research and development in LLM security practices.

📚 Read the Full Paper

📄 View on arXiv 📎 Download PDF