Sensitive File Read Followed by External Data Transmission
This rule flags a sequence where an AI agent first opens a sensitive file — source code, configs, documents, or similar — and then makes an outbound network connection shortly after. That pattern matches how an attacker or a compromised agent would exfiltrate data it just read.
How the attack works
An attacker gets an AI agent to access a sensitive file, either by tricking it through a malicious prompt or by exploiting a task that has broad file access. The agent reads the file contents into its working context. The agent (or a tool it invokes) then makes an outbound network call, such as an HTTP request, to a destination outside the organization. The rule links these two steps together, treating the file read as tainted data that flows into the network output.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 55e6f7a8-b9c0-4d12-3456-e7f8a9b0c1d2
- Severity
- High
Why it matters
Sensitive assets like source code, internal documents, or configuration files can leave the organization through an AI agent's own network access, without needing a separate malware foothold.
What you can do
- →Restrict which files an agent's file-read tool can access, especially for sensitive directories and known credential or config paths.
- →Require human approval or an allowlist before an agent can send data to external network destinations.
- →Log and review file reads paired with outbound network calls in the same task, especially to unfamiliar or newly seen endpoints.
- →Separate legitimate file-upload or CI/CD artifact-upload workflows onto known, whitelisted destinations so they don't get lost in alert noise, and treat any deviation as suspicious.
Known benign look-alikes
- Legitimate file upload features sending user-selected files to authorized services
- CI/CD pipelines uploading build artifacts to configured endpoints