Skip to main content
Exploiting vulnerabilities to manipulate the LLM into misusing legitimate tools to send sensitive data to attacker-controlled destinations.

​
How to resolve

Implement least-privilege tool design: Separate tools into distinct capabilities—tools that read sensitive data should not have network access, and tools that send data externally should not have broad file system access. Apply data flow controls: Implement explicit data flow policies that restrict which tools can access sensitive resources and which can communicate externally. Use allowlists for permitted data destinations. Monitor sensitive operations: Log and monitor all operations involving sensitive data access combined with external communication. Alert on unusual patterns such as large data transfers or communication with unknown destinations. Require explicit authorization: Implement user confirmation prompts for sensitive operations, especially when combining data access with external transmission. Use multi-factor authorization for high-risk tool combinations.

​
Risk

Governance/Compliance Data exfiltration vulnerabilities violate multiple security standards:
  • OWASP Top 10 for LLM Applications (LLM02:2025, LLM06:2025): Enables sensitive information disclosure and excessive agency by allowing LLMs to transmit confidential data through legitimate tool channels.
  • ISO/IEC 42001 (Data Protection and Privacy Controls): Violates AI management system requirements for data protection by allowing uncontrolled data flows through MCP tools.
  • GDPR (Articles 32, 33): Undermines security of processing requirements and may trigger data breach notification obligations when personal data is exfiltrated.
  • EU AI Act (Article 10): Violates data governance requirements by failing to prevent unauthorized extraction of training or operational data.
  • OWASP MCP Top 10 (MCP10:2025 - Context Injection & Over-Sharing): Enables context manipulation that causes over-sharing of sensitive data through MCP tool responses.
Security Data exfiltration through MCP tools represents a critical confidentiality breach. Attackers can leverage prompt injection, tool shadowing, or other vulnerabilities to trick the LLM into using legitimate tools (file readers, API clients, email senders) to transmit sensitive data to unauthorized recipients. This bypasses traditional data loss prevention (DLP) controls because the exfiltration appears as normal tool usage and may be difficult to distinguish from legitimate operations.

​
Explanation

This occurs when tools have both capabilities to access sensitive information and the ability to transmit data externally, creating a path for unauthorized data exfiltration through seemingly normal tool usage.

​
Specifications

Trigger
  • MCP server scan detects tool patterns that combine access to sensitive files or data with external communication capabilities (network requests, file uploads, API calls)
Severity
  • CRITICAL
Applies to: MCP Server