# Rule of Two — Exfiltration Chain Detection

- **Severity:** Critical
- **Signature ID:** `netzilo-rule-of-two-001`
- **MITRE ATLAS:** AML.T0086 (Exfiltration via AI Agent Tool Invocation)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), LLM06 (Excessive Agency)

## Summary

This detects a pattern where an AI agent, within a short window of time, pulls in outside content, reads sensitive local data, and then sends data out externally. That combination is a known way to trick AI agents into stealing information and sending it to an attacker.

## How the attack works

An attacker gets untrusted content into the agent's context, for example a malicious webpage, email, or document the agent is asked to process. That content contains hidden instructions. The agent, following those instructions, reads private data such as files, credentials, or internal records. The agent then sends that data somewhere external, such as posting it to a URL, emailing it, or writing it to a public location. The rule flags this whenever all three steps happen close together in time, in any order, including when the agent spawns child processes to do the reading or sending.

## Why it matters

Sensitive data the agent had access to — files, credentials, internal documents — can be exfiltrated to an attacker-controlled destination without a human noticing, because each individual step looks like normal agent activity.

## What you can do

- Restrict what data an AI agent can read in the same session where it also fetches external content or makes external calls.
- Require human approval before an agent writes or sends data to any external destination after it has processed untrusted input.
- Separate agent sessions or tools that handle untrusted external content from those with access to sensitive internal data.
- Review flagged sessions manually, since legitimate work that combines search, file reads, and file writes can also trigger this pattern.

## Known benign look-alikes

- Legitimate batch operations combining web search, file read, and file write

---
Source: https://www.netzilo.com/threats/rule-of-two