Automated Collection

Description

Adversaries may use automated techniques to collect data from AI systems and supporting enterprise environments. Automation may use scripts, command interpreters, command-line tools, or AI agent tools to identify, retrieve, copy, or aggregate data without a human selecting each individual item.

Collection criteria may be fixed, such as file name, type, location, owner, date. Automation may also collect repeatedly, monitor for new material, traverse related resources, or combine data from local systems, cloud services, repositories, databases, object stores, and application APIs.

In AI environments, targeted material may include models, datasets, configurations, conversation histories, retrieval databases, deployment information, logs, and other operational data.

ATLAS ID: AML.T0126
Maturity: RealizedUsed by real adversaries against AI systems in the wild.
Platforms: Enterprise

Mitigations

ATLAS 2026.09 lists no mitigation for this technique.

Case studies that use it

Related ATT&CK technique

ATLAS adapts this technique from MITRE ATT&CK Enterprise.

T1119Automated Collection

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

Description

In AI environments, targeted material may include models, datasets, configurations, conversation histories, retrieval databases, deployment information, logs, and other operational data.