Exfiltration via AI Agent Tool Invocation
Description
AI agent tools capable of performing write operations may be invoked to exfiltrate data to an adversary. Sensitive information can be encoded into the tool's input parameters and transmitted to an adversary-controlled location (such as an inbox, document, or server) as part of a seemingly legitimate action. Variants include sending emails, creating or modifying documents, updating CRM records, or even generating media such as images or videos.
The invoked tool itself may be legitimate but invoked by an adversary via LLM Prompt Injection, or the tool may be malicious (See AI Agent Tool Poisoning).
AI Agent Tool Poisoning can also be used to manipulate the inputs and destination of a separate legitimate tool, invoked through normal usage by the victim.
- ATLAS ID
- AML.T0086
- Maturity
- RealizedUsed by real adversaries against AI systems in the wild.
- Platforms
- Agentic AI
Mitigations
- AML.M0024AI Telemetry Logging
Log AI agent tool invocations to detect malicious calls.
- AML.M0026Privileged AI Agent Permissions Configuration
Configuring privileged AI agents with proper access controls for tool use can limit an adversary's ability to abuse tool invocations if the agent is compromised.
- AML.M0027Single-User AI Agent Permissions Configuration
Configuring AI agents with permissions that are inherited from the user for tool use can limit an adversary's ability to abuse tool invocations if the agent is compromised.
- AML.M0028AI Agent Tools Permissions Configuration
Configuring AI Agent tools with access controls inherited from the user or the AI Agent invoking the tool can limit an adversary's capabilities within a system, including their ability to abuse tool invocations and exfiltrate sensitive data.
- AML.M0029Human In-the-Loop for AI Agent Actions
Requiring user confirmation of AI agent tool invocations can prevent the automatic execution of tools by an adversary.
- AML.M0030Restrict AI Agent Tool Invocation on Untrusted Data
Restricting the automatic tool use when untrusted data is present can prevent adversaries from invoking tools via prompt injections.
- AML.M0032Segmentation of AI Agent Components
Segmentation can prevent adversaries from utilizing tools in an agentic workflow to compromise sensitive data sources.
- AML.M0033Input and Output Validation for AI Agent Components
Validation can prevent adversaries from utilizing tools in an agentic workflow to compromise sensitive data sources.
Case studies that use it
- AML.CS0037Data Exfiltration via Agent Tools in Copilot Studio
- AML.CS0039Living Off AI: Prompt Injection via Jira Service Management
- AML.CS0045Data Exfiltration via an MCP Server used by Cursor
- AML.CS0053Poisoned Postmark MCP Server Email Exfiltration
- AML.CS0054Data Exfiltration via Remote Poisoned MCP Tool
- AML.CS0061AI in the Middle: Web-Based AI Services as C2 Relays
- AML.CS0063Prompt-Based Attacks Against Gemini via Calendar Invitations
- AML.CS0064Poisoned GGUF Templates: Inference-Time Supply Chain Attack
- AML.CS0066ZombieAgent: Data Exfiltration Attack on ChatGPT
- AML.CS0067Claude Code GitHub Action Secret Exposure