Hunt Agent Blind Exfiltration

The tool runs your command but returns only a status, or a DLP layer blocks the sensitive output. You need a side channel. The mistake that costs hours is picking the channel before characterizing the primitive — e.g. planning a grep -q boolean oracle against a tool whose allowlist permits only cat, where every comparator is rejected and OOB DNS is the only channel that works.

Where This Lives / Attack Surface Signals

• Fixed binary status regardless of input → status-only.
• "Response blocked / content filtered" → DLP/output filter — a different tool's output may be unfiltered, and its error text may be unfiltered too.
• Tool errors quote the request back at you (URL, path, argument) → reflection channel, no egress required (T2b).
• Tool resolves hostnames / fetches URLs → outbound-capable → OOB likely.
• Response time varies with input → timing.
• Nothing observable → file-write-read or error-based only.

Crown Jewel Targets

The same secrets as tool-injection — customer PII, cloud creds, secrets-manager values — but behind an output filter. Enterprises deploy DLP on the chat response; the tool/network layer is often uninspected.