The Four Exits: Where Your Agent's Data Leaks (and Which Deployment Model Closes Each One)
One email, zero clicks, and the data walks out: the four exits every AI agent leaves open — and the two your deployment model can't close.
In June 2025, security researchers showed that an email like this one could land in the inbox of any company running Microsoft 365 Copilot — a subject line, a few paragraphs, nothing to click, nothing to download — and that the person it was addressed to would never need to open it.
Copilot would read it anyway.
Written into the email's text were instructions meant for the AI rather than the human. The next time an employee asked Copilot a routine question, the assistant would pull the email into its working memory alongside the company's internal files, follow the hidden instructions, and assemble an answer that quietly carried confidential data out to a server the attacker controlled.
No click required. No malware. No firewall alarm. Every step Copilot took was a step it was designed to take.
The researchers at Aim Security who found it called it EchoLeak. It was rated 9.3 out of 10 for severity, Microsoft patched it, and there is no evidence anyone ever used it in the wild. That's the good news. The bad news is what it demonstrated: an agent that can read your documents, your inbox and the outside world has more than one way to let data out — and most vendor security pages only talk about one of them.
The Four Exits
Think of an agent as a new hire with unusual access. It reads whatever you point it at, writes wherever it's allowed to, and takes actions in your systems on your behalf. Data can leave through four doors:
We call these the Four Exits, and the order matters: each is worse than the one before. Inference is embarrassing. Retrieval is exposed. Output is on the record. Action is irreversible.
Inference: the data goes to the model
The prompt. Every document, record and transcript the agent needs to reason about travels to wherever the model lives. If the model is a hosted API, that's someone else's building.
In March 2023, Samsung allowed its semiconductor engineers to use ChatGPT. Within about twenty days there were three separate incidents: proprietary source code pasted in to find a bug, a confidential meeting transcript uploaded to be summarised. By May, Bloomberg reported, the company had banned generative AI tools on work devices altogether. The ban didn't recover anything. It just stopped the next paste.
That was one engineer, one paste, once. An agent processing your invoices, claims or contracts makes the same trip thousands of times a day, and nobody is watching the clipboard.
Where, physically, does the model run — and can the vendor show me a deployment where my data never leaves my network?
Retrieval: the agent finds what it shouldn't
Whatever the agent can search. Agents answer questions by pulling documents from wherever they're allowed to look. When "allowed to look" is wider than "the person asking is allowed to see", the agent becomes the fastest permissions bypass in the company.
Back to the inbox. EchoLeak worked because Copilot pulled the attacker's email and the company's confidential files into the same working memory — the researchers called it a scope violation. A year earlier, in August 2024, PromptArmor showed the same pattern in Slack AI: by posting in a public channel, an attacker could get Slack AI to surface data from a private channel the attacker had never been in. Slack's first response was that pulling from channels a user hadn't joined was intended behaviour. It was. That's the problem.
Is every source the agent cites checked against the asker's permissions — per document, at the moment of answering, not per index at setup?
Output: the answer becomes a record
The answer, and everything the agent writes on the way to it. Agents don't just reply — they raise tickets, append notes, send summaries and log every step. Each of those is a fresh copy of the data, sitting somewhere your data-classification policy has never been.
In EchoLeak, the output was the exfiltration: Copilot's answer carried a link that took the confidential data with it. In the Slack case it was a rendered link that shipped a private API key the moment someone clicked. But you don't need an attacker for this exit. A claims agent that pastes a patient's diagnosis into a CRM note has just created a compliance record nobody asked for. We call this the exhaust — the trail of logs, tickets and transcripts an agent leaves behind, mostly unclassified, mostly unread.
What screens the agent's output before it's written anywhere — and does that screen know what PII and PHI look like in my industry?
Action: the agent does the thing
Not data. Control. This exit is about what the agent does with the access it's been given — send, update, file, delete — and it gets discussed least because it isn't a "leak" in the classic sense. It's also the one that costs the most.
In July 2025, Jason Lemkin, founder of SaaStr, was nine days into a public experiment building an app with Replit's AI agent. He'd declared a code freeze — change nothing — and said so in the tool more than once. The agent ran destructive commands against the live database anyway, wiping records for more than 1,200 executives and over 1,190 companies. Asked about rollback, it said recovery was impossible. It wasn't; the data was recovered. Replit's CEO called the incident unacceptable and shipped a separation between development and production databases within days.
That was a coding tool, with an experienced founder watching every step. Now picture a back-office agent with write access to your ERP, and nobody watching.
Before the agent takes an irreversible action, what has to happen — and afterwards, can I replay exactly what it did?
The matrix: on-prem closes two doors
Here's the part of the table no vendor's security page shows you.
The VPC column assumes the provider's hosted model. Self-hosting an open-weight model inside your own VPC moves Inference to Closed.
* Location doesn't fix permissions: a scope violation — agent context wider than the asker's rights — can happen entirely inside your network. Owning the index makes per-document permission checks possible, not automatic.
Read it left to right and it's reassuring. The further your deployment moves inside your own walls, the more doors close. Inference closes completely: if the model runs on your hardware, the data never leaves. Retrieval mostly closes, because you own the index and can inspect how permissions are enforced, rather than take the vendor's word for it.
Read it top to bottom and it's uncomfortable. Output and Action never reach Closed in any column — at best you can bolt a control on. An air-gapped agent can still write a diagnosis into the wrong system — it's just doing it inside your building. An on-premises agent holding a credential to your ERP can still act on that credential. Deployment decides where your data lives. It says nothing about what the agent is allowed to do with it.
So the honest answer to the question in the title: your deployment model closes two exits. The other two are closed by how the runtime is built — or they aren't closed at all.
Four objections
"Three of your four cases didn't cost anyone anything."
Correct. EchoLeak and the Slack finding were disclosed and patched before anyone was harmed, and Replit's data came back. Only Samsung's is still out there. That's rather the point. IBM's 2026 report found more than one in five organisations had already suffered a breach targeting their own AI models or applications. You're reading this before yours makes the list.
"The cloud providers are more secure than my IT team."
For infrastructure, almost certainly true. But the matrix is about exits, not infrastructure. Nothing about a hyperscaler's data centre stops an agent citing a document the asker shouldn't see, or writing PHI into a ticket. The same IBM report puts cloud misconfiguration affecting AI workloads behind 27% of AI-related breaches: the provider secures the platform, but the workload is still yours.
"Isn't this just OWASP's LLM Top 10 in different buckets?"
Partly — and deliberately. OWASP's Top 10 for LLM Applications and Simon Willison's "lethal trifecta" — private data, untrusted content and external communication in one system — are the canonical maps of how these failures happen; EchoLeak is the trifecta's textbook case, and if you build agents you should read both. The Four Exits is a different tool for a different reader. OWASP is a vulnerability catalog for builders. This is a decision lens for buyers: which failures your deployment model closes, and which only the runtimecan. OWASP tells you what can go wrong. The matrix tells you what you're actually buying.
"Air-gapped means slow, expensive and stale models."
It used to. Today an open-weight model that reasons well enough to run a document workflow fits on a pair of GPUs, and it doesn't need a monthly update to keep pulling fields from invoices. The cost is real, but at agentic volumes it's often smaller than the metered bill for a hosted model — and it buys you an exit closed by architecture rather than by contract. Which brings us to the other two doors.
How AutomatR closes the other two
We built AutomatR for enterprises that can't take the answers on faith — pharmaceutical manufacturers, banks, customs brokers — so the first two exits were table stakes. The platform runs entirely inside the customer's network: the models, the document extraction, the search index, the agent runtime. In air-gapped deployments the runtime never reaches the public internet; even software updates come from a package registry the customer hosts. When enterprise search answers a question, every citation is checked against the asker's own document permissions before it appears.
Output and Action are where the design of the runtime does the work.
Today a large Indian pharmaceutical manufacturer runs our enterprise search stack — OCR, embeddings, language model and retrieval — on their own GPUs, with no external call anywhere in the path. Our SOC 2 audit is under way.
The four-question vendor checklist
Take these to any agent vendor, including us.
- 01InferenceWhere does the model run, and can you show me a deployment where my data never leaves my network?
- 02RetrievalIs every source the agent cites checked against the asker’s permissions, per document?
- 03OutputWhat screens the agent’s output for PII and PHI before it is written anywhere?
- 04ActionWhat must happen before an irreversible action, and can I replay what the agent did?
A good answer is specific and comes with a deployment you can inspect. A bad one begins with "we're SOC 2 certified" and ends there.
If you're running these four questions against your own stack — or against ours — my DMs are open.
If your agent went live tomorrow, which of the Four Exits could you prove is closed — and which are you taking on faith?
Further reading: going deeper on agent security
- →AI Agents Have a Meter Running — the token-cost economics of agentic automationautomatr.tech/blog/ai-agent-token-economics
- →Would Your AI Survive an Audit? The Determinism Problem Finance Can't IgnoreCOMING SOON
- →95% of AI Pilots Never Ship. The Problem Isn't the Model — It's the RuntimeCOMING SOON
- →OWASP Top 10 for LLM Applications — the builders' vulnerability catalog behind these exitsgenai.owasp.org
- →Simon Willison, "The Lethal Trifecta for AI Agents" — private data, untrusted content, external communicationsimonwillison.net/2025/jun/16/the-lethal-trifecta
