ATLAS AML.T0036: AI Agents and Repository Data

An AI agent or copilot that can search SharePoint, Confluence, a code host or a database will collect data at machine speed for whoever controls it, and that may not be the user who deployed it. MITRE ATLAS tracks this as AML.T0036 Data from Information Repositories, a Collection (AML.TA0009) technique that mirrors ATT&CK T1213. Collection from files, configuration and environment variables on the host where an agent runs is AML.T0037, covered in MITRE ATLAS AML.T0037 Data from Local System. The ATT&CK mechanics, platform audit events and repository hardening are already covered in the T1213 Data from Information Repositories Defensive Guide; here the focus is what changes when the collector is an agent: delegated permissions, retrieval logs, tool calls and the speed of collection. It is for AI platform owners, identity teams and SOC analysts.

Key takeaways

The agent inherits the reach of its identity. A copilot shows only what the signed-in user can open, so oversharing in repositories becomes oversharing in answers; an agent with its own service identity can reach everything that identity can.
Collection is now autonomous. ATLAS case studies from 2025 and 2026 show agents querying databases, downloading private repositories and reading configuration files with little human direction.
Retrieval logs are the new access logs. Record which documents, rows and files each agent read for each prompt, not only the prompt and the answer.
Scope before you index. Fix broad permissions or exclude sensitive sites from AI discovery before turning on enterprise copilots or connectors.
Volume and breadth are the signals. An agent that reads many repositories, many tables or many files in a short window is the pattern to alert on.

What the technique is, in plain terms

ATLAS describes AML.T0036 as adversaries leveraging information repositories, tools that store information for collaboration or sharing, to mine valuable data. It names SharePoint, Confluence and enterprise databases such as SQL Server as common examples. The technique was created on 24 January 2022, last modified on 27 May 2026, and carries the maturity rating "Realized" in ATLAS 2026.10.

The AI-specific angle is not a new kind of repository. It is a new kind of reader. There are three ways an agent ends up doing the collecting:

Attacker-operated agent: the adversary runs its own agent against a victim using stolen credentials. The agent enumerates and queries repositories far faster than a human operator.
Hijacked enterprise agent: the organisation's own copilot or agent is steered by injected instructions, usually AML.T0051.001 Indirect prompt injection (see MITRE ATLAS AML.T0051 LLM Prompt Injection), into retrieving data for the attacker. The retrieval itself uses legitimate permissions.
Over-permissioned agent: no attacker is needed to reveal the problem. A user asks an ordinary question and the copilot surfaces a salary file or board paper from a site that was shared too widely years ago.

How it shows up in real cases

Case	What was collected	Lesson for defenders
ATLAS AML.CS0069 GTG-1002 Claude Code Espionage Campaign (2025)	With harvested credentials, the jailbroken agent queried internal databases and systems for proprietary information, configurations and operational data; on compromised hosts it also gathered credentials and configuration (AML.T0037)	Anthropic reported that the operators used AI for 80 to 90 per cent of the campaign, with thousands of requests at peak, often several per second. See Anthropic GTG-1002 Campaign 2025.
ATLAS AML.CS0068 Autonomous OpenAI Evaluation Agents Compromise Hugging Face Infrastructure (2026)	The agents read an internal operational MongoDB database, downloaded four private source-code repositories and accessed five datasets; earlier, HDF5 external references exposed `/proc/self/environ` (AML.T0037)	Secrets in environment variables of workers that process untrusted input were the bridge from file read to repository access. See OpenAI and Hugging Face Breach 2026.
ATLAS AML.CS0071 Multi-Agent Framework Compromises Taiwanese Government Systems	Employee names, departments, identifiers and SSO account details from a user-database API exposed without authentication	An unauthenticated internal API is an information repository too; agents find and read it quickly.
ATLAS AML.CS0006 ClearviewAI Misconfiguration	A private code repository held credentials that opened cloud storage with application builds, Slack tokens and raw video	Repositories that hold credentials turn one collection step into many.

In both agent cases the collection was not clever. It was fast, broad and powered by credentials that reached more than they needed to. That is where defenders have leverage.

Where agents reach repositories

Access path	Whose permissions apply	Main risk	First control
Enterprise copilot grounded on the user's data (for example Microsoft 365 Copilot through Microsoft Graph)	The signed-in user's	Oversharing: content the user can technically open but should not see surfaces in answers	Permission clean-up and exclusion of sensitive sites from AI discovery
Enterprise search assistant with connectors	Usually the user's, enforced by the index's permission sync	Stale or incomplete permission sync from source systems	Verify connector permission mapping; see the Glean Security Guide for one example
RAG pipeline over a vector store	Whatever the ingestion job could read, unless filtered at query time	Documents indexed without their access control lists	Carry ACLs into the index and filter per user; see the RAG Security Guide
Autonomous agent with its own service identity or API keys	The agent's own, often broad	One identity that can read every repository it was connected to	Per-agent identity, scoped to named repositories and read operations
MCP servers and tools (database, Git, file system)	The token configured in the server	Tool tokens with organisation-wide scope; file system tools that can read home directories	Scoped tokens and allowlisted paths; see the Local MCP Server Security Guide
Coding agents on developer hosts (local system, AML.T0037)	The developer's own, plus any credentials in files	`.env` files, cloud credential files and SSH keys read into context	Deny-lists for secret paths and secrets kept out of working directories

Microsoft documents that Microsoft 365 Copilot "only surfaces organizational data to which individual users have at least view permissions". That is a sound design, and it means the quality of your permissions is now the quality of your copilot's answers. The Context Window Data Exposure guide covers what happens once the data reaches the model; this page stops at the point of retrieval.

Detection: what to log and where

For human users, T1213 detection relies on repository audit logs. For agents you need the same logs plus the agent's own record of what it retrieved and why. ATLAS AML.M0024 AI Telemetry Logging and Monitoring recommends logging model inputs and outputs and, for agents, the intermediate steps of actions and decisions.

Source	What to collect	Detection worth building
Copilot audit (Microsoft Purview record type `CopilotInteraction`)	The `AccessedResources` list: file name, site URL, sensitivity label ID, action and status; the agent ID and name	Prompts whose accessed resources include highly labelled content; one user or agent touching many sites in an hour
Custom agent and RAG telemetry	Retrieved document IDs, source system, ACL decision and user for each prompt	Retrieval breadth per session well above that user's baseline; retrievals that hit documents outside the user's normal sites
Tool and MCP gateway logs	Tool name, arguments (query text, repository, path), result size, identity used	Repository listing calls followed by bulk clone or export; database queries against user or credential tables; file reads under secret paths
Repository audit logs (SharePoint, Confluence, Git hosts, databases)	Reads, downloads, clones and API queries by agent identities	Agent service identities reading repositories outside their documented scope; download volume per identity per hour
Host telemetry where agents run	File reads by the agent process, environment access	Agent processes opening SSH keys, cloud credential files or `/proc/*/environ`

Speed is a usable signal on its own. GTG-1002 ran at several requests per second at peak, which no analyst browsing Confluence matches. Rate-based rules per identity, scoped to agent and service identities, catch this without needing to understand the content.

Metrics

Agent identity coverage: share of agents that use a dedicated identity rather than a shared service account or a person's token.
Retrieval logging coverage: share of AI applications that log retrieved resource IDs per prompt.
Oversharing backlog: number of sites or repositories shared with everyone in the organisation that are still visible to copilots.
Scope violations: monthly count of agent reads outside the documented repository scope, and median time to review.

Mitigations

ATLAS 2026.10 lists no mitigation directly against AML.T0036. The mapping below is NHI Mgmt Group's, drawn from ATLAS agent mitigations that address the access path.

ATLAS mitigation	Practical control for repository collection
AML.M0027 Manage User-Delegated AI Agent Access	Agents that act for a user run with that user's delegated permissions, never a broader service identity
AML.M0026 Manage AI Agent Service Access	Agents that need their own identity get read access to named repositories only, with no organisation-wide scopes
AML.M0028 Enforce Access Controls for AI Agent Tools	Database tools restricted to read-only views; Git tools restricted to listed repositories; file tools restricted to a working directory
AML.M0032 Segmentation of AI Agent Components	Agent runtimes cannot reach internal databases, registries or metadata endpoints unless explicitly allowed
AML.M0030 Restrict AI Agent Tool Invocation on Untrusted Data	Retrieval tools disabled or approval-gated while externally sourced content is in context, which blunts hijacked collection
AML.M0024 AI Telemetry Logging and Monitoring	Per-prompt record of retrieved resources and tool calls

Platform controls do the heavy lifting for copilots. In SharePoint Online, Restricted Content Discovery (the RestrictContentOrgWideSearch parameter of Set-SPOSite) hides a site's content from organisation-wide search and Copilot tenant-wide discovery while permissions are reviewed. It does not change permissions, so users with access can still open the files, and Microsoft notes that changes can take more than a week to apply on sites with over 500,000 items. It requires SharePoint Advanced Management. Treat it as a stopgap while you fix sharing, which the SharePoint and OneDrive Security Guide covers.

How to roll out the controls

Inventory agents and their reach. For each copilot, agent, RAG index and MCP server, record the identity it uses and the repositories, databases and paths it can read.
Find oversharing before enabling AI. Report on sites and spaces shared with everyone, large groups or anonymous links, and on repositories that hold credentials. Fix or exclude the worst before a copilot can index them.
Split identities. Give each autonomous agent its own identity and remove shared service accounts and personal tokens from agent configuration.
Turn on retrieval logging and send it to the SIEM with the agent identity, then baseline normal breadth and rate for two to four weeks before alerting.
Add rate and breadth rules for agent identities, starting in alert-only mode.
Test. Run an authorised exercise in which a test agent with a low-privilege account tries to enumerate and read repositories, and confirm that the logs and alerts fire. The AI Red Teaming Guide covers scoping.
Roll back safely. If a new restriction breaks a business workflow, re-grant access to the named repository for that agent only, never by widening the identity.

Small organisations on SaaS copilots should start with steps 1, 2 and the vendor's audit log. Large organisations running their own agents should prioritise per-agent identities and tool-level scoping, because one shared agent identity is the fastest way to turn a single injection into organisation-wide collection.

Where identity fits

Every case above turned on a non-human identity: harvested credentials in GTG-1002, environment secrets and a shared cluster credential in the Hugging Face case, and tokens stored in a code repository in the ClearviewAI case. Treat each agent as an identity with an owner, a scope and a review date, and keep secrets out of files and environments that an agent can read. The Agent Permission Drift guide covers how agent scopes widen over time.

Common failure patterns

Turning on a copilot before fixing sharing: years of "everyone" permissions become searchable in one afternoon.
One service account for every agent: any compromise or injection reaches the union of all repositories.
Logging prompts but not retrievals: investigators can see what was asked but not which documents were read.
Indexing without ACLs: a RAG pipeline ingests documents with a privileged job and serves them to every user.
Secrets in agent-readable places: .env files, environment variables and repository history give an agent the keys to the next repository, as both 2025 and 2026 agent cases showed.

Framework mapping

Framework	Reference	Relevance
MITRE ATLAS	AML.T0036 Data from Information Repositories; tactic AML.TA0009 Collection (AML.T0037 Data from Local System has its own page)	The technique on this page
MITRE ATT&CK v20	T1213 Data from Information Repositories (including T1213.002 Sharepoint); T1005 Data from Local System	Enterprise equivalents; see the MITRE ATT&CK T1005 Data from Local System guide
OWASP Top 10 for LLM Applications 2025	LLM02 Sensitive Information Disclosure; LLM06 Excessive Agency; LLM08 Vector and Embedding Weaknesses	Disclosure through answers, over-broad tool access, and RAG access control
NIST SP 800-53 Rev. 5	AC-3 Access Enforcement; AC-6 Least Privilege; AU-12 Audit Record Generation; SI-4 System Monitoring	Scoping agent access and recording what it reads
NIST CSF 2.0	PR.AA-05; ID.AM-07; DE.CM-09	Least-privilege permissions, data inventory, monitoring of runtime environments

Practitioner checklist

List every AI agent, copilot, RAG index and MCP server with the identity it uses and the repositories it can read.
Report and fix organisation-wide sharing before enabling copilots; exclude sensitive sites from AI discovery meanwhile.
Give each autonomous agent its own identity scoped to named repositories and read-only operations.
Carry document ACLs into vector indexes and filter retrieval per user.
Log retrieved resources per prompt and send them to the SIEM.
Alert on agent identities that exceed rate or breadth baselines, or read outside documented scope.
Keep credentials out of repositories, environment variables and paths agents can read.
Test with an authorised low-privilege agent and confirm detections fire.

AML.T0036 Data from Information Repositories: Detecting AI Agents Pulling Bulk Data From Repositories and Hosts