Turn model file access into local file read
Agents with a file or code tool often resolve paths relative to the server, so traversal reads configs and secrets.
Tag: data-exfil
Cross-tenant leakage through a shared vector store
If embeddings from multiple tenants share an index without a metadata filter on every query, one tenant can retrieve another's chunks.
Confused-deputy data leak across an agent’s contexts
An agent with broad permissions can be steered to read data one user should not see and hand it to another via its own output.
Zero-click data exfiltration via markdown image rendering
If the client renders markdown images, an injected instruction encodes secrets into an image URL the victim's browser fetches automatically.