AI Recommendation Poisoning - Exfiltration via Appended URL Parameters

Ibrahim Saud@tektrix

•updated Jun 22, 2026•1•0•10

Identifies AI agents (python.exe or node.exe) making outbound GET requests where sensitive local data is extracted and appended as URL parameters for exfiltration. This rule specifically looks for URL parameters like 'q', 'data', 'context', or 'query' containing at least 50 alphanumeric characters, underscores, or hyphens, while excluding legitimate API calls to OpenAI and Anthropic.