An exfiltration chain is the step-by-step path an attacker uses to move sensitive data out of a target system. It often starts with access to local files, memory, or secrets, then stages those reads into a form that can be sent onward through DNS, HTTP, email, or another outbound channel.
In cyber security, the chain matters because defenders rarely catch data theft at a single point. The important signals are the sequence: unusual file access, followed by encoding, archiving, or encryption, then an outbound request that was not part of the normal workflow. This pattern appears in malware, insider abuse, and AI-agent abuse, where a tool is tricked into reading data and making network requests for it. Defenses focus on limiting read scope, controlling egress destinations, logging tool calls, and breaking the chain before the final transfer.