Bulk Data Exfiltration to External Party — Entire-Database Export & Confidential Disclosure
This detects attempts to get an AI agent with data-access tools to pull large amounts of sensitive data — an entire database, or a specific person's confidential records — and send it somewhere outside the organization. It catches the instruction itself, not the actual network transfer.
How the attack works
An attacker sends the agent a request combining two elements: a bulk or highly sensitive scope (e.g. 'the entire database of patient records', or a named individual's therapy sessions and diagnoses) plus an external destination (e.g. 'to an external server', 'to external parties'). This can arrive as a direct instruction or as injected content the agent processes. Because the agent has legitimate data-access tooling, it may comply and attempt to move the data across the trust boundary in a single step. The rule flags this pattern of instruction, whether it originates from a user prompt or a poisoned document/tool output.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 050b6647-d15b-4cd2-a41e-934ccc6fe9be
- Severity
- High
Why it matters
If successful, an organization loses bulk sensitive records — patient data, personal information, confidential case details — to a party outside its control, creating a data breach with regulatory, legal, and reputational consequences.
What you can do
- →Require human approval for any agent action that exports data in bulk or sends data to a destination outside approved internal systems.
- →Restrict agent tool permissions so data-access tools cannot write to arbitrary or external endpoints by default; maintain an allowlist of approved destinations.
- →Log and review all instructions (from users or from content the agent ingests) that combine broad data scope with an external destination, even if the agent refuses.
- →Separate roles for data retrieval and data transmission so no single instruction can both pull an entire dataset and send it externally without a second checkpoint.
Known benign look-alikes
- Legitimate sharing with authorized internal stakeholders or named medical professionals ('share the report with authorized stakeholders / the treating physician').
- Backups to internal/company secure storage, or generic disaster-recovery backups without a bulk+external combination.
- Security research corpora cataloguing ASB attack strings as reference samples — should be allowlisted by a reviewer.