AI agent traffic is the data exchanged between an AI-enabled client or coding tool and an AI service. It can include prompts, model responses, tool instructions, metadata, and-depending on the design-API credentials or other sensitive information.
This traffic matters because a tool or intermediary that routes requests may be able to inspect or alter them. In attacks, a repackaged AI client or compromised service could redirect traffic through attacker-controlled infrastructure, potentially exposing prompts, source code, or tokens; exposure depends on the implementation and should not be assumed without evidence. Defenders should use trusted clients, check where requests are sent, limit secrets in prompts, protect API keys, and monitor unexpected outbound connections.