# Indirect PI — File Exfiltration Combined with Destroy or Tamper

- **Severity:** Critical
- **Signature ID:** `79677264-4c33-4e08-ac2c-7b9a2489d008`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.001 (Indirect)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI07 (Unsafe Autonomous Code Execution), LLM01 (Prompt Injection), LLM06 (Excessive Agency)

## Summary

An AI agent that reads external content (documents, emails, web pages) can be manipulated by hidden instructions embedded in that content. This attack pattern goes further than simple data theft: it makes the agent copy sensitive files like API keys or banking details, then destroy or edit the originals so the theft goes unnoticed.

## How the attack works

An attacker plants hidden instructions inside a file, document, or other content that an AI agent is expected to process. When the agent reads this content, it follows the embedded instructions instead of the user's actual request. First, the agent is directed to locate and copy out a sensitive file from cloud storage — credentials, financial data, or similar. Then, in a second step, the same injected instructions have the agent either delete the source file or modify its contents. The result is that the original data is gone or altered, making the theft much harder for the victim to detect than if the file had simply been copied.

## Why it matters

An organization can lose sensitive data such as API keys or financial records while also losing the ability to notice the breach quickly, since the source file is deleted or tampered with rather than left intact for review.

## What you can do

- Restrict AI agents' write and delete permissions on cloud storage separately from read permissions, so an agent that reads sensitive files cannot also modify or remove them.
- Require human approval for any agent action that deletes or overwrites files, especially after the same session read a sensitive file.
- Log and monitor file access followed closely by deletion or modification of the same file, particularly for files containing credentials or financial data.
- Treat legitimate migration or backup workflows as an expected exception and document them so real exfil-and-destroy patterns stand out.

## Known benign look-alikes

- Legitimate file migration workflows that copy and then clean up the original location
- Backup tools that move files from one location to another

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00707

---
Source: https://www.netzilo.com/threats/atr-indirect-pi-file-exfiltration-combined-with-destroy-or-tampe