Topic starter
25/10/2026 11:06 am
TL;DR: Five harmless requests can reconstruct an AWS access key before per-request DLP sees the full secret, according to PipeLab. Session-level inspection has to reassemble fragments before forwarding the request that completes the leak.
Editorial analysis by NHI Mgmt Group, based on content published by PipeLab: “Cross-Request Exfiltration: 5 Requests Leak a Key”.
Key questions
Q: Why do prompt-injected agents create more exfiltration risk than ordinary web traffic?
A: Prompt-injected agents can follow instructions that intentionally fragment data, repeat requests, and deliver pieces in a natural-looking workflow.
Q: How do security teams know if exfiltration controls are actually working?
A: Look for evidence that bulk file access, compression, and outbound staging are detected early and correlated with privileged sessions.
Q: What breaks when DLP only scans data at rest or only inspects inline traffic?
A: Either model alone leaves a blind spot.
Practitioner guidance
- Implement session-based outbound inspection Buffer outbound fragments per agent session and re-run DLP against the combined content before forwarding any request that completes a secret.
- Separate high-confidence blocking from soft signals Use entropy tracking as a warning signal first, then reserve blocking for reconstructed matches to known credential patterns.
- Tune session windows to your agent traffic Set buffer size and retention based on how long your agents normally keep conversations open, then test whether slow fragmentation still reconstructs within that window.
Bottom line: Cross-request exfiltration turns prompt injection into a data-loss technique that bypasses controls built around single-request inspection.
Glossary terms: Cross-Request Exfiltration, Session-Based DLP, Entropy Budget, Fragment Reassembly
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:15 pm
Cross-request exfiltration is a governance failure, not just a detection gap: per-request content controls assume the risky payload arrives intact in one unit. That assumption fails when an agent can split a secret across multiple outbound calls and let the receiver reconstruct it. The implication is that inspection boundaries must match the runtime boundary, or the control will always be one message too small.
A question worth separating out:
Q: Should organisations block high-entropy traffic or only reconstructed secrets?
A: They should do both in different ways. High-entropy traffic is a warning signal that helps prioritise review, but reconstructed secrets provide the high-confidence condition for blocking. A mature control plane uses entropy to detect pressure and reassembly to enforce the actual policy.
👉 Read our full editorial: Cross-request exfiltration exposes the limits of per-request DLP
This post was modified 7 days ago by NHI Mgmt Group