# Indirect PI — Data Exfiltration with Evidence Destruction (Exfil-and-Delete)

- **Severity:** Critical
- **Signature ID:** `3aaa0f08-e614-4c6a-9e2a-6773a99cb470`
- **MITRE ATLAS:** AML.T0051.001 (Indirect), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI03 (Identity and Impersonation), ASI09 (Traceability and Accountability Gaps), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

This detects a prompt injection attack that hides instructions inside content an AI agent reads, such as a document or email. The hidden instructions tell the agent to grab sensitive data, send it somewhere, and then delete the original file or sent message so no one notices.

## How the attack works

An attacker plants text inside a file, webpage, or email that the AI agent will process as part of its normal job. That text is a hidden command, invisible to the human user, instructing the agent to collect sensitive information and send it to an external destination. After sending, the injected instructions tell the agent to delete the source file, delete the sent email, or otherwise edit records to erase evidence the exfiltration happened. The rule also covers a bulk-email variant where the agent forwards many messages and then deletes them from the sent folder.

## Why it matters

An organization loses sensitive data and loses the ability to detect or investigate the theft afterward, because the normal traces (the file, the sent email) are gone. This is worse than plain data leakage because it defeats after-the-fact incident response.

## What you can do

- Restrict agents that can read untrusted external content from also having delete or edit permissions on files, emails, or logs.
- Log agent actions to a location the agent itself cannot modify or delete, so deletion attempts don't erase the audit trail.
- Require human approval before an agent deletes files or sent emails, especially right after an external send action.
- Review any workflow where an agent both sends data externally and cleans up afterward, and confirm that behavior was intentionally configured, not injected.

## Known benign look-alikes

- Email cleanup workflow that archives sent items to a folder after delivery
- Automated backup that moves processed files to a completed directory
- Security documentation explaining exfil-and-destroy attack techniques

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00858
- https://github.com/CUA-Framework/VPIBench
- https://arxiv.org/abs/2408.11972

---
Source: https://www.netzilo.com/threats/atr-indirect-pi-data-exfiltration-with-evidence-destruction-exfi