The machines that build and run AI hold an unusual concentration of valuable local data: model weights, training sets, notebooks, provider API keys and the configuration of every tool an agent can call. MITRE ATLAS tracks the searching of those local sources as AML.T0037 Data from Local System, in the Collection tactic (AML.TA0009), and rates it as realised. It mirrors ATT&CK T1005 Data from Local System, which covers the general endpoint technique; this page covers only the AI-specific angle: what is worth collecting on AI hosts, how language models and agents now do the collecting, and how to detect and limit it. It is for ML platform, endpoint and SOC teams, and for anyone who runs coding agents or notebooks on machines that hold real credentials.
Key takeaways
- AI hosts are rich targets. Developer laptops, notebook servers and training nodes hold SSH keys, cloud and model provider tokens, datasets and model files side by side.
- The collector can be a model. In ATLAS case study AML.CS0044 (LAMEHUG), malware asked a hosted LLM to write its collection commands, and in the 2025 Nx compromise a malicious package tried to use AI tools already installed on the victim's machine to search for sensitive files.
- Your own agent can collect for the attacker. An agent with file and shell tools can be steered by injected content or a jailbreak to gather local data, as in the GTG-1002 campaign (AML.CS0069).
- Collection is the last quiet step before exfiltration. Bulk reads of home directories, credential paths and environment variables by a new process or an agent session are the signal to catch.
- Least data beats best detection. Keep secrets out of files, keep agents out of credential paths and keep sensitive datasets off general-purpose endpoints.
What ATLAS means by Data from Local System
Repository-side collection is covered in MITRE ATLAS AML.T0036 Data from Information Repositories. ATLAS describes AML.T0037 as adversaries searching local system sources, such as file systems, configuration files or local databases, to find files of interest and sensitive data before exfiltration, including basic fingerprinting information and sensitive data such as SSH keys. The technique was added in May 2021 and last modified in May 2026 (ATLAS release 2026.10). It sits in Collection and usually precedes AML.T0025 Exfiltration via Cyber Means or, for agents, AML.T0086 Exfiltration via AI Agent Tool Invocation.
The ATT&CK technique already explains endpoint collection in general. What changes on AI systems is the target set and the collector:
- Different targets: model artifacts and datasets (which overlap with AML.T0035 AI Artifact Collection), notebook outputs, local vector stores, and agent configuration holding tool credentials (AML.T0083).
- Different collectors: LLM-generated commands, local AI command-line tools invoked by malware, and legitimate agents whose file tools are turned against their owner.
- Different logs: the evidence may sit in agent tool-call logs and model provider logs rather than only in endpoint telemetry.
What is worth collecting on an AI host
| Local source | Examples | Why an attacker wants it |
|---|---|---|
| Developer credentials | ~/.ssh/, ~/.gitconfig, cloud CLI credential files, package registry tokens | Access to code, cloud accounts and publishing pipelines |
| Environment and process data | Shell environment variables, /proc/self/environ in containers | Model provider keys and service tokens passed at start-up |
| Agent and tool configuration | MCP client configuration, agent settings files, .env files in project folders | One file can hold credentials for every tool the agent uses |
| Notebooks | .ipynb files with stored outputs, kernel histories | Outputs often contain sample data, query results and pasted keys |
| Model artifacts | Fine-tuned weights, adapters, tokenizer and config files | Intellectual property; input to model theft or attack staging |
| Datasets and indexes | Local training and evaluation sets, embedding stores, cached retrieval documents | Personal or confidential data; insight into what the model knows |
| Fingerprinting data | Hostname, username, working directory, /etc/hosts, DNS settings | Targeting and planning of the next step |
Secrets in notebooks deserve their own sweep; see How to find secrets in Jupyter notebooks.
How it has been used against AI systems
| Case | What was collected locally | AI-specific lesson |
|---|---|---|
| AML.CS0015 Compromised PyTorch Dependency Chain (December 2022) | A malicious torchtriton package installed with PyTorch-nightly read DNS settings, hostname, username, environment variables, /etc/hosts, /etc/passwd, the first 1,000 files in $HOME, .gitconfig and .ssh, then sent them out through encrypted DNS queries | ML dependency chains run code on the machines that hold research credentials. See the PyTorch torchtriton supply chain attack. |
| AML.CS0044 LAMEHUG (2025) | Python malware, attributed by CERT-UA with medium confidence to APT28, used the Hugging Face API to query Qwen 2.5-Coder-32B-Instruct for reconnaissance and data theft commands, saved system information to a text file and recursively searched Documents, Desktop and Downloads | The collection logic came from a model at run time, so static signatures of the commands are less useful than behaviour |
| Nx package compromise (August 2025) | Malicious nx versions ran a post-install script that scanned the file system for text files and credentials, wrote an inventory to /tmp/inventory.txt and pushed results to a repository in the victim's own GitHub account; Nx's post-mortem says it attempted to use local AI tools such as Claude and Gemini to scan for sensitive data | AI command-line tools installed on a laptop can be invoked by other code as a file-search engine |
| AML.CS0069 GTG-1002 (September 2025) | A jailbroken Claude Code agent gathered credentials, system configurations and sensitive operational data on compromised systems | Agent frameworks speed up local collection after access. See the Anthropic GTG-1002 campaign. |
| AML.CS0068 OpenAI evaluation agents and Hugging Face (2026) | HDF5 external references disclosed /proc/self/environ and worker source files on a dataset processing service | Data-processing features of AI pipelines can read local files on the attacker's behalf |
Local data collection via agents
The newest form of AML.T0037 needs no malware. A coding or desktop agent already has a file reader, a search tool and often a shell, running with the user's own permissions. Three routes turn it into a collector:
- Injected instructions: content the agent reads (a web page, an issue, a document or a tool description) tells it to look for keys or files and include them in an output or tool call. ATLAS tracks the instruction step as AML.T0051 LLM Prompt Injection (see MITRE ATLAS AML.T0051 LLM Prompt Injection) and the exit as AML.T0086.
- Misuse by the operator: a jailbroken or malicious deployment, as in GTG-1002, where the agent's broad local access is the point.
- Invocation by other code: malware or a malicious package calls the locally installed agent CLI non-interactively, as reported in the Nx case, so the search runs through a trusted binary.
The controls are the same in each case: limit which paths the agent can read, require approval when a read of sensitive data is followed by an outbound action, and log every tool call with its arguments. The AI Coding Agents Security Guide and the AI Agent Sandboxing and Code Execution Guide cover the containment patterns in depth.
Detection
| Where | What to look for |
|---|---|
| Endpoint file telemetry (EDR, auditd, macOS Endpoint Security) | Bursts of reads across $HOME, .ssh, cloud credential and agent configuration paths by a process that has not done so before, especially a package manager child process or an agent shell |
| Process creation | Agent CLIs launched non-interactively by package install scripts, scheduled tasks or unknown parents; agent CLIs started with permission prompts disabled |
| Agent tool-call logs (AML.M0024 AI Telemetry Logging and Monitoring) | File search or read tools targeting credential paths; recursive listings of home directories; tool arguments that contain key-shaped strings |
| Staging artefacts | New inventory or archive files in temporary directories shortly after a package install or agent session |
| Model provider and gateway logs | Unexpected calls from endpoints to hosted model APIs by non-approved processes, which may be malware asking a model for commands |
| Network and DNS | Long encoded DNS queries, uploads to new repositories or paste sites after a collection burst |
D3FEND D3-FAPA File Access Pattern Analysis describes the core analytic. Canary credentials in agent configuration and home directories turn a quiet read into a high-confidence alert; see AI Agent Honeytokens and Canaries.
Metrics
- Plaintext secret count: literal credentials found on AI developer endpoints and notebook servers, trending to zero.
- Agent path coverage: share of agents whose file and shell tools are confined to the project workspace.
- Tool-call logging coverage: share of agent sessions with full tool arguments retained centrally.
- Canary time to alert: time from a canary read to a SOC alert.
- Rotation time: time from a confirmed collection event to every exposed credential rotated.
Mitigations
ATLAS release 2026.10 does not link a mitigation directly to AML.T0037. The controls below are NHI Mgmt Group recommendations mapped to related ATLAS mitigations.
- Confine agent file access: run agents in a container or sandbox with only the project directory mounted, and deny reads of credential paths (AML.M0032 Segmentation of AI Agent Components, AML.M0028 Enforce Access Controls for AI Agent Tools).
- Gate read-then-send sequences: require approval before an agent that has read untrusted content performs a sensitive read or an outbound call (AML.M0030 Restrict AI Agent Tool Invocation on Untrusted Data, AML.M0029 Human In-the-Loop for AI Agent Actions).
- Remove what can be collected: replace literal secrets with references to a secret manager or credential helper, clear notebook outputs before saving, and keep sensitive datasets on controlled storage rather than laptops (AML.M0005 Control Access to AI Models and Data at Rest, AML.M0012 Encrypt Sensitive Information).
- Control what runs at install: pin ML dependencies by hash, configure package indexes so a public package cannot override an internal one, and disable install scripts where the toolchain allows it. See the Malicious Package and Dependency Confusion Guide.
- Govern local AI tools: inventory agent CLIs on endpoints, keep their permission prompts on by policy and alert when they are launched by an unexpected parent.
- Log for reconstruction: keep agent tool-call logs with arguments (AML.M0024) next to endpoint telemetry so a collection event can be traced to the prompt or content that caused it.
Where identity fits
Most of what AML.T0037 harvests on AI hosts is non-human identity material: SSH keys, provider API keys, registry tokens and the tool credentials in agent configuration. Short-lived, narrowly scoped credentials issued per user and per tool shrink what a collection run is worth, and an inventory of where each credential lives makes rotation after an incident fast. See MITRE ATLAS AML.T0083 Credentials from AI Agent Configuration and the AI Agent Credential Lifecycle and Rotation Guide.
How to test
- Seed canaries: place canary keys in a test user's home directory,
.envfiles and agent configuration on a lab endpoint. - Agent probe: in an authorised test, feed the agent benign content containing an instruction to locate configuration files, and confirm the sandbox blocks the read or an approval prompt appears.
- Install-time probe: install a harmless internal test package whose install step reads a canary path, and confirm endpoint telemetry raises the expected alert.
- Non-interactive CLI launch: start an approved agent CLI from a script in the lab and confirm the parent-process detection fires.
- Trace end to end: check the SOC can join the agent tool-call log, endpoint events and network logs for each test into one timeline.
Rolling it out
- Inventory: find AI developer endpoints, notebook servers and training nodes, and the agent CLIs and extensions on them.
- Sweep: scan for literal secrets in home directories, notebooks and agent configuration; move them to references and rotate as you go.
- Confine in audit mode: apply agent path restrictions and sandbox mounts in log-only mode for two weeks to find legitimate workflows that break.
- Enforce: turn on blocking for credential paths first, then wider home-directory restrictions; keep a documented exception process.
- Detect: deploy the file-access, process and canary analytics, then run the tests above.
- Roll back safely: if a restriction blocks critical work, widen the specific path rule for that team, never disable the sandbox, and never restore a rotated secret.
Common failure patterns
- Agent runs with the whole home directory: the agent's file tool can reach
.sshand cloud credentials because it was installed with default user permissions. - Notebooks saved with outputs: query results and printed keys committed with the notebook and copied to shared drives.
- Nightly and experimental packages on credentialed machines: research installs on the same laptop that holds production keys, the pattern behind the PyTorch case.
- Prompts disabled for convenience: agent CLIs configured to skip confirmation, so any caller can drive them.
- Endpoint logs without agent logs: the EDR shows file reads by the agent process but nothing shows which prompt or document caused them.
- Rotating only the key that was abused: leaving every other credential the collection run could have read still valid.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATLAS | AML.T0037 (AML.TA0009 Collection); related AML.T0035, AML.T0083, AML.T0086, AML.T0025 | Technique, adjacent collection and exfiltration |
| MITRE ATLAS mitigations | AML.M0005, AML.M0012, AML.M0024, AML.M0028, AML.M0029, AML.M0030, AML.M0032 | Data at rest, telemetry, tool permissions, approval, segmentation |
| MITRE ATT&CK | T1005 Data from Local System; related T1083, T1552.001, T1119, T1074 | Enterprise equivalent and neighbouring steps |
| OWASP Top 10 for LLM Applications 2025 | LLM02 Sensitive Information Disclosure, LLM06 Excessive Agency | Agent over-reach and data exposure |
| OWASP Top 10 for Agentic Applications | ASI02 Tool Misuse and Exploitation, ASI03 Identity and Privilege Abuse | File tools turned against the owner; privilege of agent identity |
| NIST SP 800-53 Rev. 5 | AC-3, AC-6, SC-28, SI-4, AU-12 | Access enforcement, least privilege, data at rest, monitoring, audit records |
| NIST CSF 2.0 | PR.AA-05, PR.DS-01, DE.CM-09 | Access policy, data at rest, runtime monitoring |
| MITRE D3FEND | D3-FAPA, D3-FA, D3-UBA | File access patterns, file analysis, behaviour analytics |
Practitioner checklist
- Inventory AI developer endpoints, notebook servers and the agent CLIs installed on them.
- Remove literal secrets from home directories, notebooks and agent configuration.
- Confine agent file and shell tools to the project workspace; block credential paths.
- Require approval for sensitive reads and outbound calls after untrusted input.
- Pin ML dependencies and stop public indexes overriding internal package names.
- Alert on agent CLIs launched by unexpected parents or with prompts disabled.
- Retain agent tool-call logs with arguments alongside endpoint telemetry.
- Place canary credentials and test the alert path quarterly.
- After any collection event, rotate every credential the process could have read.
Standards and references
- MITRE ATLAS: AML.T0037 Data from Local System
- MITRE ATLAS: LAMEHUG, Malware Leveraging Dynamic AI-Generated Commands
- MITRE ATLAS: GTG-1002 Claude Code Espionage Campaign
- MITRE ATT&CK: T1005 Data from Local System
- PyTorch: Compromised PyTorch-nightly dependency chain
- Nx: Security advisory GHSA-cxm3-wv7p-598c
- Nx: s1ngularity post-mortem
- Anthropic: Disrupting AI-orchestrated cyber espionage
Related NHI Mgmt Group resources: MITRE ATLAS Guide · MITRE ATLAS AML.T0035 AI Artifact Collection · MITRE ATLAS AML.T0086 Exfiltration via AI Agent Tool Invocation · Developer Workstation and IDE Security Guide