# Indirect PI — Cloud File Exfiltration (Google Drive / Cloud Storage via Agent)

- **Severity:** Critical
- **Signature ID:** `0f9b929e-4a0c-4ff4-9cc8-be33f76f35bd`
- **MITRE ATLAS:** AML.T0051.001 (Indirect), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI03 (Identity and Impersonation), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

An AI agent that can browse the web or access files reads a page or document containing hidden instructions. Those instructions tell the agent to fetch sensitive files from the user's Google Drive, Dropbox, or OneDrive and send them to an outside destination, either by uploading them to an attacker's site or attaching them to an email.

## How the attack works

An attacker plants hidden text in a webpage, form, or document that the agent will later read while doing an unrelated task. When the agent processes that content, the embedded instructions redirect it to search the user's connected cloud storage for sensitive material such as API keys, bank details, card numbers, or archived emails. The agent then either uploads the found files to an external platform under the attacker's control or attaches them to an outgoing email addressed to the attacker. The user never sees or approves this action; it happens as a side effect of the agent following the injected instructions.

## Why it matters

Sensitive files stored in the victim's cloud drive—financial data, credentials, private correspondence—can be silently copied out to an attacker, without the user's knowledge or an explicit request.

## What you can do

- Restrict what cloud storage scopes and folders an agent can access by default; require explicit per-task approval for reading sensitive directories.
- Require human confirmation before an agent uploads files to external sites or attaches files to outgoing emails.
- Treat any content an agent reads from the web or third-party documents as untrusted input, and strip or ignore instruction-like text embedded in it.
- Log and review agent actions that combine cloud-file reads with outbound uploads or email sends, especially to unfamiliar destinations.

## Known benign look-alikes

- Legitimate file sharing workflow attaching Drive documents to emails for collaboration
- Backup service documentation describing cloud file synchronization
- Security documentation analyzing cloud storage exfiltration techniques

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00857
- https://github.com/CUA-Framework/VPIBench
- https://arxiv.org/abs/2408.11972

---
Source: https://www.netzilo.com/threats/atr-indirect-pi-cloud-file-exfiltration-google-drive-cloud-stora