AG-002: Data Exfiltration Path

What this rule means

The agent has both data-reading tools and network-egress tools with no boundary between them. Severity is graduated: plain READ+NETWORK is MEDIUM (common in benign agents); sensitive read (DB, files, secrets) + network is HIGH; sensitive read + exec + network is CRITICAL.

For the formal IFC proof-based version of this finding, see AG-TRIFECTA.

Why it matters

Without a data-flow boundary, a prompt injection can instruct the agent to read sensitive data and send it to an attacker endpoint. The agent has no way to distinguish a legitimate send from an attacker-instructed one.

How to fix it

• Separate into two agents: one that reads data (no network), one that sends (no data access). They communicate through a trusted gateway.
• Add a DLP/sanitization layer between read and send.
• Restrict the network tool to an allowlist of known-safe destinations.
• Add human approval for any combined read+send operation.

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-002          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules