AI Agent Sandbox Exfiltrating PII via xauth Token Query Parameter

Duo Tech@duotech

•updated Aug 21, 2026•2•0•7

Detects an AI agent sandbox exfiltrating harvested PII/session context by embedding it as an x-auth-token query parameter in an outbound HTTP request to an external host — the network-observable exfiltration stage of Cryptographic Context Injection.