Threat alert
Data-egress-after-read: the agent leak nobody tests for
By Prof. Abhik Roychoudhury, Co-founder & Chief Expert, Verigrey · Provost's Chair Professor, NUS · ACM Fellow1 min readUpdated
A class of violation where an agent exfiltrates data only after touching a sensitive record. Why checklists miss it and how adaptive testing catches it.
Static policy checklists typically test "does the agent ever call an external tool with sensitive data" and "does the agent ever read a sensitive record" as separate questions. The violation we’re flagging only appears when both happen in sequence, and only on certain conversational paths.
Because the unsafe behavior is conditional on state accumulated earlier in the trajectory, single-turn red-team prompts essentially never trigger it. Adaptive exploration that tracks state across the whole run finds it reliably.