Yes. An agent that logs tool inputs and outputs to files accessible outside its sandbox has an exfiltration channel built into its normal operation. A prompt injection that instructs the agent to include sensitive content in its log entries, or to write data to a log path accessible to an external observer, requires no network access and bypasses most data loss prevention controls.
Analysis Briefing
- Topic: Log-based data exfiltration channels in AI agent deployments
- Analyst: Mike D (@MrComputerScience)
- Context: A back-and-forth with Claude Sonnet 4.6 that went deeper than expected
- Source: Pithy Security
- Key Question: If your AI agent logs everything it does, who else can read those logs?
Why Logging Is an Exfiltration Channel Nobody Monitors for Outbound Data
Security teams treat logs as a detection and forensics resource, not as an exfiltration risk. Log files are written to, collected by SIEM tools, and monitored for incoming threat indicators. They are rarely analyzed for outbound data leakage embedded in log content.
An AI agent that logs full tool call inputs and outputs writes the content of every document it processes, every query it runs, and every API response it receives into log files. If those log files are shipped to a centralized logging platform, a SIEM, or a third-party observability service, the sensitive content travels with them.
A prompt injection that instructs the agent to log specific content to a specific path, or to include sensitive information in a structured log field that aggregation tools capture automatically, exfiltrates data through a channel that DLP tools do not cover.
The Prompt Injection That Writes Secrets Into Structured Log Fields
Structured logging formats like JSON are designed for machine parsing. An agent that logs tool results as JSON includes nested content from tool outputs verbatim in the structured fields. An attacker who can influence tool outputs, through a malicious web page a browsing agent fetches or a document a RAG pipeline retrieves, controls what gets written into structured log fields.
The attack does not require the agent to have direct file system write access outside its sandbox. If the logging framework captures the agent’s outputs and ships them off-host, the exfiltration happens through the logging infrastructure itself.
This is the logging equivalent of a covert channel. The data leaves through a path that is explicitly permitted and monitored but in the wrong direction.
When Log Scrubbing Actually Prevents Sensitive Content from Leaving
Log scrubbing middleware that strips or redacts sensitive content before log emission addresses this attack class. The scrubber operates on log records before they are written, ensuring that sensitive patterns, PII, credentials, and document content do not appear in log output regardless of what the agent processed.
Effective scrubbing requires knowing what to redact. Pattern-based scrubbing catches known formats: credit card numbers, API key patterns, email addresses. Content-based redaction for arbitrary document text requires more aggressive approaches like limiting log verbosity for tool results and logging summaries rather than full content.
The design principle is minimal logging of sensitive content. Log that a tool was called, what tool, and whether it succeeded. Do not log the full content of every document the tool processed unless forensic completeness is explicitly required and log access is appropriately controlled end-to-end.
What This Means For You
- Audit what your AI agent logging framework writes to disk and ships off-host, because full tool call logging with inputs and outputs may be exfiltrating document content through your own observability infrastructure.
- Implement log scrubbing middleware that redacts sensitive patterns before log emission, because DLP tools that monitor network egress do not inspect log content shipped to SIEM or observability platforms.
- Restrict log file permissions so that agent log files are writable by the agent process but readable only by authorized monitoring systems, not by other processes or users in the same environment.
- Log tool call metadata rather than full content by default, keeping full content logging for debug modes with explicit access controls and short retention periods.
Enjoyed this deep dive? Join my inner circle:
- Pithy Security → Stay ahead of cybersecurity threats.