# Bulk Data Exfiltration to External Party — Entire-Database Export & Confidential Disclosure

- **Severity:** High
- **Signature ID:** `050b6647-d15b-4cd2-a41e-934ccc6fe9be`
- **MITRE ATLAS:** AML.T0025 (Exfiltration via Cyber Means), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI02 (Tool Misuse and Exploitation), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

This detects attempts to get an AI agent with data-access tools to pull large amounts of sensitive data — an entire database, or a specific person's confidential records — and send it somewhere outside the organization. It catches the instruction itself, not the actual network transfer.

## How the attack works

An attacker sends the agent a request combining two elements: a bulk or highly sensitive scope (e.g. 'the entire database of patient records', or a named individual's therapy sessions and diagnoses) plus an external destination (e.g. 'to an external server', 'to external parties'). This can arrive as a direct instruction or as injected content the agent processes. Because the agent has legitimate data-access tooling, it may comply and attempt to move the data across the trust boundary in a single step. The rule flags this pattern of instruction, whether it originates from a user prompt or a poisoned document/tool output.

## Why it matters

If successful, an organization loses bulk sensitive records — patient data, personal information, confidential case details — to a party outside its control, creating a data breach with regulatory, legal, and reputational consequences.

## What you can do

- Require human approval for any agent action that exports data in bulk or sends data to a destination outside approved internal systems.
- Restrict agent tool permissions so data-access tools cannot write to arbitrary or external endpoints by default; maintain an allowlist of approved destinations.
- Log and review all instructions (from users or from content the agent ingests) that combine broad data scope with an external destination, even if the agent refuses.
- Separate roles for data retrieval and data transmission so no single instruction can both pull an entire dataset and send it externally without a second checkpoint.

## Known benign look-alikes

- Legitimate sharing with authorized internal stakeholders or named medical professionals ('share the report with authorized stakeholders / the treating physician').
- Backups to internal/company secure storage, or generic disaster-recovery backups without a bulk+external combination.
- Security research corpora cataloguing ASB attack strings as reference samples — should be allowlisted by a reviewer.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01807

---
Source: https://www.netzilo.com/threats/atr-bulk-data-exfiltration-to-external-party-entire-database-exp