Cross-request exfiltration: are your DLP controls keeping up?

TL;DR: Prompt injection can split an AWS access key across multiple requests so per-request DLP sees only harmless fragments, while cross-request buffering and re-scanning catch the reconstructed secret before it leaves the proxy, according to PipeLab. The key failure is assuming each request is the unit of risk when the agent can distribute exfiltration over a session.

Editorial analysis by NHI Mgmt Group, based on content published by PipeLab: “Cross-Request Exfiltration: 5 Requests Leak a Key”.

Key questions

Q: What breaks when DLP only scans data at rest or only inspects inline traffic?

A: Either model alone leaves a blind spot.

Q: Why do prompt-injected agents create more exfiltration risk than ordinary web traffic?

A: Prompt-injected agents can follow instructions that intentionally fragment data, repeat requests, and deliver pieces in a natural-looking workflow.

Q: How do security teams know if exfiltration controls are actually working?

A: Look for evidence that bulk file access, compression, and outbound staging are detected early and correlated with privileged sessions.

Practitioner guidance

• Implement session-based outbound inspection Buffer outbound fragments per agent session and re-run DLP against the combined content before forwarding any request that completes a secret.
• Separate high-confidence blocking from soft signals Use entropy tracking as a warning signal first, then reserve blocking for reconstructed matches to known credential patterns.
• Tune session windows to your agent traffic Set buffer size and retention based on how long your agents normally keep conversations open, then test whether slow fragmentation still reconstructs within that window.

Bottom line: Cross-request exfiltration turns prompt injection into a data-loss technique that bypasses controls built around single-request inspection.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →