Cross-request exfiltration exposes the limits of per-request DLP

At a glance

What this is: This is an analysis of cross-request exfiltration in agent traffic, showing that fragmenting a secret across separate requests defeats per-request DLP but not session-based reassembly.

Why it matters: It matters because IAM and security teams governing agents, APIs, and secrets need controls that inspect the full session, not just isolated requests, when runtime instruction channels can be abused to leak credentials.

Context

Per-request inspection treats each outbound call as independent, but agent behaviour can turn a single secret into a multi-request leak that only becomes visible when fragments are recombined. That creates a governance gap for prompt injection and for any control that assumes the risky content will appear intact in one message.

For NHI and agentic AI programmes, the issue is not just whether a secret is present, but whether the runtime can be induced to distribute that secret across multiple tool calls or HTTP requests. Once the agent becomes the delivery mechanism, traditional content filters lose the unit of analysis they were built around.

Key questions

Q: What breaks when DLP only scans data at rest or only inspects inline traffic?

A: Either model alone leaves a blind spot. Inline controls may stop live leakage but miss historical exposure, while API-based scanning can find stored risk after the fact but cannot prevent the original transfer. Mature programmes need both movement control and repository coverage.

Q: Why do prompt-injected agents create more exfiltration risk than ordinary web traffic?

A: Prompt-injected agents can follow instructions that intentionally fragment data, repeat requests, and deliver pieces in a natural-looking workflow. That means the attacker gets a built-in splitter and courier without custom malware. The risk rises when the organisation assumes each request is independent instead of part of a longer session.

Q: How do security teams know if exfiltration controls are actually working?

A: Look for evidence that bulk file access, compression, and outbound staging are detected early and correlated with privileged sessions. If teams only see the breach after a leak site post, the control failed. Effective monitoring should surface unusual data movement before attackers can weaponise it.

Q: Should organisations block high-entropy traffic or only reconstructed secrets?

A: They should do both in different ways. High-entropy traffic is a warning signal that helps prioritise review, but reconstructed secrets provide the high-confidence condition for blocking. A mature control plane uses entropy to detect pressure and reassembly to enforce the actual policy.

Technical breakdown

How cross-request exfiltration defeats per-request DLP

Per-request DLP inspects each message or request in isolation, so it only works when the full secret appears in one payload. Cross-request exfiltration breaks that assumption by splitting a credential into fragments such as query parameters, body text, or even parameter names, then reassembling them on the receiving side. The control failure is structural: the detector never sees the complete secret at the moment any single request passes. Session-level buffering changes the inspection boundary from packet to conversation, which is the only level at which this attack becomes visible.

Practical implication: Inspect outbound data at the session layer, not just the request layer, when agents can make repeated calls to the same destination.

Why entropy tracking helps, but does not solve the problem

Entropy tracking measures how random or token-like outbound data looks over time. High-entropy strings such as keys, hashes, and encoded blobs consume a budget quickly, so repeated exfiltration attempts can be flagged even when they do not match a known secret pattern. But entropy is only a signal, not a proof. Legitimate traffic can also be high-entropy, including JWTs, code snippets, and encoded parameters. That makes entropy useful for triage and throttling, but unreliable as a stand-alone blocker in environments where agents routinely move structured data. See the AI Agent Observability, Audit and Incident Response Guide.

Practical implication: Use entropy as a pressure signal, then pair it with content reassembly before blocking traffic outright.

How fragment reassembly turns split leaks into a detectable secret

Fragment reassembly stores outbound pieces per session and re-runs DLP against the concatenated buffer on every new request. That means the final fragment that completes an AWS key, token, or other credential is the request that gets blocked. This is stronger than pattern matching on each request because it restores the full context that the attacker intentionally removed. The important design choice is the state boundary: session identity, buffer size, and retention window determine whether the detector can reconstruct enough of the secret before fragments age out or drift into a different session. See the API Key Management Guide.

Practical implication: Re-scan combined outbound fragments before forwarding the request that completes the secret.

Threat narrative

Attacker objective: The attacker wants to reconstruct and steal a usable AWS access key without triggering request-by-request DLP controls.

1. Entry begins with a prompt injection that instructs the agent to exfiltrate an AWS key in fragments instead of sending it in one request.
2. Credential access occurs when the agent turns the secret into partial values across multiple tool calls and outbound requests.
3. Escalation happens as the fragments are reassembled on the receiving side while per-request DLP still sees only harmless pieces.
4. Impact is the successful leakage of the full AWS access key unless session-based reconstruction blocks the final fragment before it leaves the proxy.

Breaches seen in the wild

• AI LLM hijack breach: attackers used stolen AWS access keys to hijack Anthropic LLM models on Bedrock.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Cross-request exfiltration is a governance failure, not just a detection gap: per-request content controls assume the risky payload arrives intact in one unit. That assumption fails when an agent can split a secret across multiple outbound calls and let the receiver reconstruct it. The implication is that inspection boundaries must match the runtime boundary, or the control will always be one message too small.

Session state is now part of the control surface: if the security decision is made only on a single request, the system is blind to the behaviour that matters most. Agents do not need custom malware to fragment data because the orchestration layer already provides the splitting, sequencing, and delivery mechanics. That makes session-level reconstruction a first-class governance requirement for prompt injection defence.

Entropy budgeting creates useful friction, but it is not equivalent to prevention: high-entropy outbound data is suspicious, yet many legitimate agent workflows also produce encoded or token-like strings. The correct interpretation is that entropy identifies pressure, not proof. Practitioners should treat it as a secondary signal that narrows the field, not as evidence that the exfiltration path is closed.

Runtime boundary control is the right named concept here: the security question is no longer whether an individual request is clean, but whether the combined session can be coerced into disclosing a secret across time. That shift changes the governance unit from message to session, and practitioners should evaluate every outbound control on whether it still works after fragmentation.

What this signals

Runtime boundary control: outbound inspection has to follow the agent session, not the individual request, because fragmentation is now a normal exfiltration pattern rather than an edge case. That makes the conversation, not the packet, the relevant enforcement boundary for agent-era data loss controls.

Where agents can split, reorder, and delay sensitive content across multiple calls, DLP that only understands isolated payloads will remain structurally incomplete. The operational question is whether your proxy, gateway, or observability layer can reconstruct intent before the final fragment leaves the environment.

For practitioners

• Implement session-based outbound inspection Buffer outbound fragments per agent session and re-run DLP against the combined content before forwarding any request that completes a secret.
• Separate high-confidence blocking from soft signals Use entropy tracking as a warning signal first, then reserve blocking for reconstructed matches to known credential patterns.
• Tune session windows to your agent traffic Set buffer size and retention based on how long your agents normally keep conversations open, then test whether slow fragmentation still reconstructs within that window.
• Test cross-request exfiltration explicitly Create red-team cases where a credential is split across query parameters, request bodies, and parameter names so you can verify the proxy blocks the final fragment.

Key takeaways

• Cross-request exfiltration turns prompt injection into a data-loss technique that bypasses controls built around single-request inspection.
• The article’s example shows that five harmless requests can reconstruct a full AWS access key, which is enough to defeat per-request DLP.
• The control implication is clear: inspect sessions and reassemble fragments before forwarding the request that completes the secret.

Related NHI Mgmt Group resources: Prompt Injection Guide · AI Agent Observability, Audit and Incident Response Guide · Shadow AI and AI Agent Discovery Guide · Agentic AI Security Guide

Key terms

• Cross-Request Exfiltration: A leakage pattern where sensitive data is broken into pieces and sent across multiple requests so no single message looks dangerous on its own. In agentic environments, this turns the session into the real unit of risk because the receiver can reassemble the fragments later.
• Session-Based DLP: A data loss prevention approach that buffers and evaluates outbound content over a session instead of inspecting each request in isolation. It is designed to catch fragmented secrets, delayed disclosures, and multi-step leaks that per-request controls cannot see.
• Entropy Budget: A threshold for how much high-entropy outbound data a session can emit before it is flagged or blocked. It helps identify token-like or encoded exfiltration, but it is only a signal and can produce false positives when legitimate traffic is naturally random-looking.
• Fragment Reassembly: The process of collecting outbound pieces from a session and reconstructing the full payload before policy evaluation. In this article’s context, it is the high-confidence method that allows DLP to catch a split credential at the moment the final fragment completes the secret.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.