Adversaries may utilize Direct Prompt Injection, Indirect Prompt Injection or other methods to instruct enterprise AI agents to exfiltrate data.[1][2] When enterprise systems incorporate the use of AI assistants or other AI agents, adversaries may abuse these systems to weaponize sanctioned tools available to the agent.[3]
As an AI agent processes queries or ingests data, an injected prompt can cause the agent to use its tool connections in unauthorized or unintended ways. When AI agents are induced to exfiltrate data, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration to Code Repository or Exfiltration Over Web Service.[4][5]
| ID | Mitigation | Description |
|---|---|---|
| M1048 | Application Isolation and Sandboxing |
Ensuring that LLM/AI systems are contained to only within the organizational network with no outside access can contain the exfiltration of sensitive data to within an organizational network. |
| M1022 | Restrict File and Directory Permissions |
Restrict file permissions to limit the exposure of sensitive data from AI agents. |
| M1017 | User Training |
Employ user training to include the implications of AI agent use within corporate environments |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0927 | Detect AI-Enabled Exfiltration | AN2079 |
An analyst observes an AI-associated process access data outside $AuthorizedAIDataScope$, followed within $EndpointExfilWindow$ by transfer-capable execution and an outbound connection to a destination outside $AuthorizedAIEndpoints$ from the same process lineage. |
| AN2078 |
An analyst observes an AI agent access $ProtectedDataScope$, invoke a tool/API using that information or a derived payload, and the destination service record a successful transfer to a recipient, repository, tenant, domain, or service outside $AuthorizedAIDataFlows$. |
||
| AN2080 |
An analyst observes an AI-associated process access data outside $AuthorizedAIDataScope$, followed within $EndpointExfilWindow$ by transfer-capable execution and an outbound connection from the same lineage to a destination outside $AuthorizedAIEndpoints$. |