Notifications
Clear all
Topic starter
21/08/2026 4:55 pm
TL;DR: RAG-enabled LLMs can leak stored secrets through prompt injection and browser-rendered image requests, with ActiveFence showing how malicious URLs, double-TLD domains, and external sources can turn memory into a covert exfiltration channel. The risk is no longer just prompt abuse; it is a governance problem spanning memory, rendering, and third-party integrations.
NHIMG editorial — based on content published by ActiveFence: Exfiltrating Secrets from LLM Memory and the lessons from the red team trenches
By the numbers:
- Only 44% of organisations are currently using a dedicated secrets management system.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing access credentials.
Questions worth separating out
Q: How should security teams prevent LLM memory from leaking sensitive data?
A: Limit what the model is allowed to remember, separate low-risk personalization from regulated or secret material, and assume every retained field can become an attack target.
Q: Why do RAG systems increase data exfiltration risk?
A: RAG systems expand the trust boundary because the model can pull in external content, then transform that content into output or tool actions.
Q: What breaks when browser-rendered LLM output is not controlled?
A: Generated HTML, especially image tags and links, can create automatic outbound requests that carry secrets to attacker-controlled infrastructure.
Practitioner guidance
- Constrain AI memory to explicit trust scopes Separate benign personalization from sensitive business context, and prevent long-lived memory from storing secrets, credentials, or regulated data unless a clear business need exists.
- Inspect generated URLs after canonicalisation Apply outbound URL validation after normalising domains, subdomains, and TLD structures so double-TLD tricks and encoded destinations cannot bypass controls.
- Strip executable instructions from retrieved content Treat browser pages, documents, and file metadata as untrusted inputs before they reach the model.
What's in the full article
ActiveFence's full blog covers the operational detail this post intentionally leaves for the source:
- Proof-of-concept examples for multi-domain and double-TLD exfiltration patterns
- Browser and URL handling details that show where safelists and scanners can be bypassed
- Specific defensive considerations for RAG sources, file metadata, and HTML rendering
- Red-team testing approaches for identifying covert memory leaks in AI workflows
👉 Read ActiveFence's analysis of LLM memory exfiltration through RAG →
LLM memory exfiltration through RAG: are your controls keeping up?
Explore further
21/08/2026 5:12 pm
Stateful AI creates a new secrets-governance problem, not just a prompt-safety problem. Once an LLM stores user context across sessions, it begins to resemble a privileged system that can recall and expose sensitive information. That changes the control model from one-time input filtering to ongoing protection of memory, retrieval, rendering, and delegated access paths. Practitioners should treat RAG memory as governed data, not convenience metadata.
A question worth separating out:
Q: Who is accountable when an AI assistant overshares sensitive content?
A: Accountability sits with the team that owns the policy, the attribute feeds, and the enforcement points, because ABAC only works when all three are managed together. If any one of them is missing, the organisation has not built a defensible control path, even if the model itself appears constrained.
👉 Read our full editorial: LLM memory exfiltration turns RAG into a covert data channel
