# Sensitive File Read Followed by External Data Transmission

- **Severity:** High
- **Signature ID:** `55e6f7a8-b9c0-4d12-3456-e7f8a9b0c1d2`
- **MITRE ATLAS:** AML.T0086 (Exfiltration via AI Agent Tool Invocation)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), LLM02 (Sensitive Information Disclosure)

## Summary

This rule flags a sequence where an AI agent first opens a sensitive file — source code, configs, documents, or similar — and then makes an outbound network connection shortly after. That pattern matches how an attacker or a compromised agent would exfiltrate data it just read.

## How the attack works

An attacker gets an AI agent to access a sensitive file, either by tricking it through a malicious prompt or by exploiting a task that has broad file access. The agent reads the file contents into its working context. The agent (or a tool it invokes) then makes an outbound network call, such as an HTTP request, to a destination outside the organization. The rule links these two steps together, treating the file read as tainted data that flows into the network output.

## Why it matters

Sensitive assets like source code, internal documents, or configuration files can leave the organization through an AI agent's own network access, without needing a separate malware foothold.

## What you can do

- Restrict which files an agent's file-read tool can access, especially for sensitive directories and known credential or config paths.
- Require human approval or an allowlist before an agent can send data to external network destinations.
- Log and review file reads paired with outbound network calls in the same task, especially to unfamiliar or newly seen endpoints.
- Separate legitimate file-upload or CI/CD artifact-upload workflows onto known, whitelisted destinations so they don't get lost in alert noise, and treat any deviation as suspicious.

## Known benign look-alikes

- Legitimate file upload features sending user-selected files to authorized services
- CI/CD pipelines uploading build artifacts to configured endpoints

---
Source: https://www.netzilo.com/threats/taint-file-exfil