Skip to content
ExfilPath
ResearchHow agent breaches work

Stop your AI agent
from leaking customer data, API keys, private email, CRM records, internal docs

ExfilPath reads your agent's code and finds every path where attacker-controlled input can reach an action that leaks data — then shows the change that closes it.

Start freeSee how it works
  • Free forever plan
  • No credit card
  • Your code never leaves your browser
exfilpath.tech/reports/email-triage-agent

Overview

7ms · static analysis, nothing executed

Export report

Open paths

22 critical

Exposure

96/100 · grade F

Closed by controls

00 controls found

Files analyzed

473 lines

critical

Inbound email reaches network egress

82%

Source

Inbound email

Model

OpenAI call

No guard on the value

Action

HTTP request

critical

Inbound email reaches auto-fetched render

72%
Suggested fixone-line

Pin the destination to an allowlist

+const ALLOWED_HOSTS = new Set(['hooks.example.com']);
+if (!ALLOWED_HOSTS.has(url.hostname)) throw blocked;
-await fetch(link, { method: "POST", body });
+await safeFetch(link, { method: "POST", body });

Closes this path on re-scan

Integrations

Works with the stack your agent already runs on

Built-in detectors for the models and frameworks agents are written with, and for the apps where untrusted input gets in and data gets out.
  • OpenAIModel calls
  • AnthropicModel calls
  • Google GeminiModel calls
  • Amazon BedrockModel calls
  • LangChainChains and retrievers
  • Vercel AI SDKgenerateText, streamText
  • MCPTool results
  • OllamaLocal models
  • PlaywrightScraped pages
  • OpenAIModel calls
  • AnthropicModel calls
  • Google GeminiModel calls
  • Amazon BedrockModel calls
  • LangChainChains and retrievers
  • Vercel AI SDKgenerateText, streamText
  • MCPTool results
  • OllamaLocal models
  • PlaywrightScraped pages
  • GmailInbound email
  • OutlookInbound email
  • SlackMessages in, posts out
  • SalesforceRecords in, writes out
  • HubSpotRecords in, writes out
  • JiraTickets in, writes out
  • ZendeskTicket text
  • NotionPage writes
  • StripePayments
  • TwilioSMS sends
  • GmailInbound email
  • OutlookInbound email
  • SlackMessages in, posts out
  • SalesforceRecords in, writes out
  • HubSpotRecords in, writes out
  • JiraTickets in, writes out
  • ZendeskTicket text
  • NotionPage writes
  • StripePayments
  • TwilioSMS sends
ReadsTypeScriptJavaScriptPythonBrowse every detector

How it works

From repository to fix in three steps.

Scanners grade components one at a time. Attackers use the path between them. ExfilPath finds that path.
  1. inbox.tsagent.pynotify.ts
    1

    Add your code

    Drop in a file, a folder or a whole repository. It is read in your browser — never uploaded, never executed.

  2. 2

    See every path

    ExfilPath traces untrusted input through your code and the model to any action that can leak data.

  3. - fetch(link, …)+ safeFetch(link, …) Path closed
    3

    Ship the fix

    Each open path comes with the smallest change that closes it, written in the language of the file.

Platform

Everything you need to trust a finding.

Built for agent code, not generic web patterns.
inbox.tstriage-agent.ts modelnotify.ts

Follows the data across files and through the model

Values are traced through assignments, helpers and files. The model call is treated as a trust boundary, not a filter.

  • Destination allowlistClosed
  • Schema validationClosed
  • No control on valueOpen

Credits the guards you already have

Routes with an allowlist, schema or approval gate are reported as closed, not as noise.

+ if (!ALLOWED.has(host)) throw
- await fetch(link)
+ await safeFetch(link)

A fix, not a warning

Every open path comes with the smallest change that closes it — usually a few lines.

Static analysis onlyNo credentials neededNothing uploaded

Never runs your code

Fully static. No sandbox, no credentials, no prompts sent to a model provider.

LLM02:2025LLM05:2025LLM06:2025CWE-918CWE-74CWE-200CWE-94

Mapped to OWASP and CWE

Every finding carries an OWASP LLM Top 10 category and a CWE identifier.

Detectors for the stack you use

TypeScript, JavaScript and Python, across the frameworks agents are built on.

OpenAIAnthropicGoogle GeminiAmazon BedrockLangChainLangGraphLlamaIndexVercel AI SDKMCPMicrosoft GraphGmailSalesforcePlaywrightPinecone
detectors in the engine
46
17 input surfaces · 15 actions · 9 controls · 5 model boundaries
languages traced end to end
3
TypeScript, JavaScript and Python
lines of your code executed
0
Analysis is static. No model provider involved.
for a typical agent service
<1s
From adding a repository to the full report

Research

Built on how real agent breaches worked.

EchoLeak and ForcedLeak passed every component check. Both are the exact shape ExfilPath reports.

EchoLeak

CVE-2025-32711Microsoft 365 Copilot

One crafted email made Copilot send sensitive context to an attacker’s server — with zero clicks.

Inbound emailCopilotAuto-fetched image
ExfilPath reports: open critical pathRead the analysis

ForcedLeak

CVSS 9.4Salesforce Agentforce

Text in a public web form made Agentforce leak CRM records through an image request.

Web-to-Lead formAgentforceImage request
ExfilPath reports: open critical pathRead the analysis

Testimonials

Engineers who put the platform against their own agents.

NovaGrid Systems
“Our scanners were green while an email could still walk a summary straight out to an external host. ExfilPath was the first tool that drew that route instead of handing us another list.”
RSRupesh ShresthaPrincipal AI Engineer · NovaGrid Systems
QuantumLeaf Technologies
“The part that changed my mind was the trace through the model call. Everyone talks about prompt injection in the abstract; this showed the exact three lines that made it exploitable.”
PKPriya KarkiSenior Machine Learning Engineer · QuantumLeaf Technologies
VertexScale Labs
“It reads the repository, finds where untrusted text enters, and tells you which action it can reach. We closed two paths with one-line changes the same afternoon.”
ARAayush RaiStaff Backend Engineer · VertexScale Labs
HyperNova Cloud
“What I want from a security tool is a decision, not a dashboard. Open path or no open path is a decision my team can act on in a release meeting.”
OTOliz ThapaDirector of Platform Engineering · HyperNova Cloud

Pricing

Start free. Upgrade when your team needs more.

The Free plan includes the full analyzer, forever. Plans for teams are coming soon.

Free

Available now

The full analyzer for individual engineers. Free forever.

$0forever
Start free
  • Browser analyzer for files, folders and repositories
  • Unlimited analyses
  • Full path traces with the model boundary marked
  • Fix guidance on every open path
  • JSON and written report export
  • OWASP LLM Top 10 and CWE mapping
  • Community support

Developer

Coming soon

For an individual engineer or a single agent in production.

$49per developer / month
Notify me
  • Everything in Free
  • 1 developer seat
  • Up to 5 projects
  • CLI and CI severity thresholds
  • Personal report history
  • Community support

Team

Coming soon

For a team shipping agents on a shared codebase.

$99per developer / month
Notify me
  • Everything in Developer
  • Unlimited projects and repositories
  • Shared report history and path timeline
  • Pull-request comments on new and closed paths
  • Per-repository policy thresholds
  • SARIF export and code scanning integration
  • Ownership routing for open paths
  • Email support, one business day

Business

Coming soon

For organizations running many agents across many teams.

$199per developer / month
Notify me
  • Everything in Team
  • Organization-wide path dashboard and trends
  • SSO with Google, Microsoft and Okta
  • Role-based access and audit trail
  • Custom input surfaces, actions and controls
  • Release evidence export for audits
  • Priority support with a named contact

Enterprise

For regulated environments and code that cannot leave the network.

  • Self-hosted or air-gapped deployment
  • Private detector packs for internal frameworks
  • Architecture review with our research team
  • Contractual SLAs and security review support
Talk to us

Prices are in USD and exclude local taxes. Annual billing is charged yearly and saves roughly 20%.

Compare all plans

FAQ

Frequently asked questions

Can't find what you need? Write to hello@exfilpath.tech and an engineer will answer.

What exactly does ExfilPath check?

One question, thoroughly: whether attacker-controlled input can reach an action that causes damage. It maps the input surfaces, maps the sensitive actions, looks for controls on the value in between, and reports every route where nothing stands in the way.

How is this different from a code scanner?

A scanner grades components and returns a list. ExfilPath composes components into routes. A repository can have zero scanner findings and still contain a route from an email body to an outbound request, which is exactly how EchoLeak and ForcedLeak worked.

Do you run my agent or send prompts to a model?

No. Analysis is static: your code is read in your browser, never executed, and no model provider is called at any point.

Which languages and frameworks are supported?

TypeScript, JavaScript and Python today, with detectors for LangChain, LangGraph, LlamaIndex, the Vercel AI SDK, MCP servers, OpenAI, Anthropic, Gemini, Bedrock, Microsoft Graph, Gmail, Salesforce, Playwright, vector stores and common web frameworks. Java and Go are on the roadmap.

What does it cost?

The Free plan is free forever and includes the full browser analyzer with unlimited analyses. Developer, Team and Business plans for teams are coming soon, and Enterprise is available on request.

How do you handle false positives?

Every path carries its full trace and a confidence score, so a finding can be confirmed or dismissed in seconds. Existing controls are detected too, so a route you have already closed is reported as closed rather than repeated as a warning.

Find the path before an attacker does.

Analyze your first agent in two minutes. Free forever, no credit card.
Start freeTalk to us