# Injected Code — Local File Exfiltration to a Remote Endpoint

- **Severity:** High
- **Signature ID:** `fafeb811-3f32-4b58-8855-034368d5bdaa`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM02 (Sensitive Information Disclosure), LLM05 (Improper Output Handling)

## Summary

An attacker hides instructions inside content an AI agent processes — a webpage, document, or email — telling it to write code that reads a local file and sends it out over the network. If the agent complies and runs or outputs that code, sensitive files can leave the environment without the user asking for it.

## How the attack works

An attacker plants malicious instructions in some external content the AI agent will read, such as a web page, PDF, or email body — this is indirect prompt injection. The hidden instructions coerce the agent into generating a code snippet that opens and reads a local file. In the same piece of code, that file's contents are sent out via HTTP POST, FTP upload, a raw socket connection, or Bluetooth to a destination the attacker controls. The detection looks for this specific pairing: a local file read tied directly to a remote-send action in one statement, which is the signature of intentional exfiltration rather than ordinary file handling.

## Why it matters

If the agent executes or hands off this generated code, local files — credentials, source code, private documents, configuration secrets — can be silently copied to an attacker's server, resulting in data theft without any visible user action.

## What you can do

- Require human review before any agent-generated code that touches the filesystem is executed or deployed.
- Restrict AI agents from having filesystem read access to sensitive directories unless strictly necessary for the task.
- Block or monitor outbound connections to unfamiliar hosts from environments where agents execute generated code.
- Sanitize or isolate external content (web pages, documents, emails) before an agent processes it, to reduce the chance of embedded instructions influencing its output.

## Known benign look-alikes

- Security documentation, papers, or test suites that describe this attack technique without executing it.
- Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01890

---
Source: https://www.netzilo.com/threats/atr-injected-code-local-file-exfiltration-to-a-remote-endpoint