Context Window Sensitive Data Exfiltration

Adversary Behavior: Adversaries exfiltrate data through the output channels of AI systems integrated into development environments by manipulating an AI assistant's behavior through prompt injection to collect and transmit sensitive data from its context window.

AI/IDE Mechanism: The LLM's native context assembly mechanism serves as the collection system — the adversary does not deploy separate collection tooling but instead subverts the AI's existing access to project files and environment data. The context window contains source code, credentials, API schemas, and infrastructure configurations assembled by the IDE during normal operation.

Execution Path: The adversary directs the AI system through prompt injection to collect sensitive data from its context window and transmit it through available output channels. Exfiltration channels include: markdown or HTML rendering that triggers network requests to adversary-controlled URLs with data encoded in the request path or parameters; code generation that embeds sensitive data in output committed to adversary-accessible repositories; tool invocation arguments that include sensitive data in web requests or file write operations; and AI API traffic routed through adversary-controlled proxies.

Security Impact: Sensitive data including source code, credentials, API schemas, and infrastructure configurations are exfiltrated through channels that are difficult to distinguish from legitimate AI assistant operations, bypassing traditional DLP controls designed for conventional exfiltration patterns.