Join our Newsletter — 33% off our NHI Course

Read-then-send pattern

A read-then-send pattern occurs when a tool or agent first accesses sensitive data and then transmits it through another server, process or network destination. It is a practical exfiltration signal in agentic environments because the danger emerges from the sequence of actions, not any single request alone.

What the read-then-send pattern means in practice

The read-then-send pattern is valuable because it captures a sequence, not just a single action. A tool or agent may legitimately read sensitive material, but once that material is followed by transmission to another server, process or network destination, the behaviour becomes an exfiltration signal that deserves scrutiny.

This matters most in agentic environments where tool use, retrieval and outbound network access can happen in the same workflow. The pattern is often visible only when telemetry is correlated across steps, so a single read event or a single network event can look harmless on its own.

Why the sequence matters for security monitoring

The security value of the pattern is that it links data access to data movement. That linkage helps defenders distinguish normal processing from suspicious handling of secrets, records or other sensitive content, especially when an agent has permission to inspect data but not to export it.

Detection improves when organisations treat the read and the send as one chain of behaviour rather than separate logs. If the destination is unfamiliar, external, or inconsistent with the task, the sequence can indicate unauthorised forwarding, covert collection, prompt-induced leakage or an abuse of permitted tool access.

Where false positives and blind spots appear

Not every read followed by a send is malicious. Backups, telemetry pipelines, sanctioned integrations and user-requested exports can create the same surface pattern, which means context is essential before escalating an alert.

The main blind spot is assuming that access control alone is enough. A well-authenticated agent or service can still misuse a valid session if it is allowed to read sensitive content and then hand that content to another endpoint without destination controls, content inspection or task-aware guardrails.

How organisations should interpret it during investigations

A read-then-send event should prompt investigators to ask whether the destination was expected, whether the data type was appropriate for the task, and whether the sequence matches the system’s normal workflow. When the pattern involves credentials, tokens or session material, the review should also consider whether those materials may have been exposed beyond their intended boundary.

For agentic systems, the most useful interpretation is behavioural: the agent may have stayed within its individual permissions while still violating the intended data-handling boundary. That is why the pattern is often treated as an exfiltration precursor, not just a generic data movement event.

Risk and Threat Considerations

Read-then-send behaviour can be a practical exfiltration signal because it combines data access with outbound transfer. The risk is highest when the destination is outside the normal trust boundary, when the transferred material is sensitive, or when the workflow allows the sequence to happen without human review.

Failure mechanism: An attacker, compromised agent, or over-permissive workflow reads data first, then forwards it through a second process or endpoint that bypasses the original control boundary, making the transfer harder to spot than a direct export.

Impact: Sensitive records, secrets, tokens, or other protected material can leave the environment with valid-looking activity, creating confidentiality loss, downstream account abuse, and delayed detection of compromise.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
OWASP Agentic AI Top 10 ASI02 — Tool Misuse Read-then-send sequences expose agents misusing tools to move sensitive data outward.
Recommendation — Monitor tool chains for unexpected read-to-send patterns and block unapproved outbound destinations.
OWASP Non-Human Identity Top 10 NHI-02 — Secret Leakage The pattern can reveal secrets or tokens being read and then exfiltrated from an NHI workflow.
Recommendation — Detect secret reads followed by egress and rotate exposed credentials immediately.
MITRE ATT&CK T1020 — Exfiltration The sequence models data being taken from a system and sent to an external destination.
Recommendation — Correlate access and network telemetry to identify staged exfiltration activity.
NIST SP 800-53 Rev 5 AU-12 — Audit Record Generation The pattern depends on audit data that links reads and outbound transfers across components.
SC-7 — Boundary Protection Outbound transmission after reading sensitive data is a boundary-control issue.
Recommendation — Generate audit records that connect sensitive reads with subsequent network transfers. Enforce boundary protections that restrict sensitive data from reaching unapproved destinations.

Practitioner Guidance

What to watch for: Treat the pattern as a correlation problem, not a single-event rule. The useful question is whether the same actor, task or agent that accessed the data also caused an outbound transmission to a destination that the workflow does not normally require.

Governance implication: Ownership should span both data access and data egress, because one team often sees only half the story. The control objective is to make sensitive reads traceable to an intended downstream use, with clear review points for unusual destinations or high-value data classes.