Prompt injection and API key exfiltration: what actually happens

Prompt injection is the attack vector that turns AI agents into exfiltration channels. This is the concrete attack chain — and the structural defenses that stop keys from ever being available to steal.