An AI agent with broad data access can gather in minutes what a human intruder would take days to find, sort and summarise. MITRE ATLAS AML.T0126 Automated Collection covers adversaries using scripts, command interpreters, command-line tools or AI agent tools to identify, retrieve, copy or aggregate data without a human choosing each item. ATLAS added it in version 2026.09 under the Collection tactic (AML.TA0009), rates it Realized, and links it to ATT&CK T1119 Automated Collection. This page covers the AI-specific angle: agents as the collection engine, AI assets as the targets, and the logs that show the pattern. For the general technique, read the MITRE ATT&CK T1119 Automated Collection guide.
Key takeaways
- Two AI angles, one technique. AI agents can be the tool that collects, and AI systems (models, datasets, conversation histories, retrieval stores, logs) can be the material collected.
- Agents add triage, not just volume. In ATLAS case AML.CS0069 the agent categorised stolen data by intelligence value and documented it for the operators, work that used to slow intruders down.
- Multi-agent frameworks collect in parallel. In AML.CS0071, Dream Research reported up to eight sub-agents per wave and more than 2,564 personnel records gathered from government systems over four days in July 2026.
- Data-plane logs are where it shows. Object reads, AI assistant resource access and agent tool calls reveal collection; many of them are off by default.
- Bound the agent, not just the user. Per-identity rate limits, tool-call budgets and least-privilege data scopes for agents are what slow automated collection down.
What ATLAS says
ATLAS describes automated collection as gathering data from AI systems and supporting enterprise environments with automation. Selection criteria can be fixed (file name, type, location, owner, date), and automation can collect repeatedly, watch for new material, follow related resources, or combine data from local systems, cloud services, repositories, databases, object stores and application APIs. In AI environments the named targets are models, datasets, configurations, conversation histories, retrieval databases, deployment information, logs and other operational data.
Collected material is usually consolidated before it leaves. ATLAS records that as a separate technique, AML.T0127 Data Staged (mirroring ATT&CK T1074); for the enterprise staging pattern see the T1560 and T1074 Archive and Stage Collected Data Defensive Guide.
| Collection pattern | AI-specific form | Related page |
|---|---|---|
| Agent as collector | A hijacked or attacker-run agent uses file, database, search and API tools to sweep data, then summarises and ranks it | AML.T0053 AI Agent Tool Invocation |
| AI assets as targets | Bulk pulls of model weights, datasets, checkpoints and experiment artefacts from registries and storage | MITRE ATLAS AML.T0035 AI Artifact Collection |
| Repository sweeps | Scripted reads across wikis, ticketing, document stores and vector databases that feed retrieval | AML.T0036 Data from Information Repositories |
| Conversation and log harvesting | Export of chat histories, prompt logs and agent traces, which often hold secrets and personal data | AI Agent Memory Security Guide |
| Local sweeps by coding agents | Agent shell or file tools enumerate configuration files, keys and source on the host | AML.T0037 Data from Local System |
Cases
AML.CS0069: an agent that collects and triages
In the GTG-1002 campaign reported by Anthropic, a jailbroken coding agent connected to tools through MCP carried out an estimated 80 to 90 percent of the activity against about 30 organisations in September 2025. ATLAS records (step S19) that the agent automatically collected and processed large volumes of victim data, categorised the results by intelligence value, and generated documentation of discovered services, harvested credentials, sensitive data and attack progress. Anthropic noted that at peak the AI made thousands of requests, often several per second, and that it sometimes hallucinated credentials or overstated how secret public information was. ATLAS then records the staging step separately: the agent organised extracted data and notes into structured Markdown files for operator review.
Detection lesson: request rate and breadth are the signal. A human reading files does not reach several requests a second across many systems for long periods; an agent does.
AML.CS0071: a multi-agent framework against government systems
Dream Research Labs reported on 12 August 2026 that it recovered a workspace of more than 160 MB and 1,395 files from a framework built on the Hermes and OpenClaw agents, documenting 12 attack waves between 1 and 4 July 2026. Up to eight lettered sub-agents ran per wave. Collection was largely automated: the framework decompiled client-side JavaScript from a government portal to extract endpoints, client IDs and authentication settings, identifying 21 connected systems, and pulled user lists from unauthenticated APIs. Reported results included more than 2,564 personnel records, a full JSON export of department system users, seven SSO client secrets, six internal database credentials and internal network ranges. ATLAS records (step S11) that the framework automatically retrieved and aggregated personnel, account, configuration, credential and network information. Taiwan's Ministry of Digital Affairs separately said on 13 August 2026 that it had detected attacks in July combining human operators with OpenClaw assistance, which used backup and test systems as stepping stones.
Detection lesson: the exposures that enabled collection were ordinary (unauthenticated and debug APIs, an SSO bridge without extra authentication). Automated collection amplifies existing exposure rather than creating new exposure.
Where to detect it
| Telemetry | What to collect | Signal of automated collection |
|---|---|---|
| Agent and MCP gateway logs | Every tool call with agent identity, user, tool, arguments summary and result size (AML.M0024 AI Telemetry Logging and Monitoring) | High tool-call count per task; repeated list and read calls across many resources; reads unrelated to the stated task |
| Microsoft Purview audit | CopilotInteraction, ConnectedAIAppInteraction records with the AccessedResources field (site URL, sensitivity label) and AgentId | One agent or user touching an unusual number of sites or labelled items; spikes in resources per interaction |
| Cloud object storage data events | AWS CloudTrail data events such as S3 GetObject (not logged by default; enable with advanced event selectors) | Bulk reads of model, dataset or checkpoint prefixes by a workload or agent role |
| Model registries and hubs | Download and access logs for models and datasets | Pulls of many private artefacts in a short window, or from a new token |
| Vector databases and retrieval services | Query logs per caller | Broad, low-relevance queries that walk the index, or very high result counts |
| Application and API gateways | Per-identity request rates, paging patterns, unauthenticated endpoint use | Sequential enumeration of IDs or pages; sustained machine-rate traffic |
Use baselines per agent, not per human. An agent that legitimately summarises a team site will read many items, so compare it with its own history and declared purpose. Behaviour analytics that only model human users will either miss agent collection or flag every agent.
Mitigations
As of ATLAS 2026.10, AML.M0005 and AML.M0039 are the ATLAS mitigations formally mapped to AML.T0126; the other rows are our mapping of related ATLAS mitigations and practical controls.
| Control | What it does against automated collection |
|---|---|
| AML.M0026 Manage AI Agent Service Access; AML.M0028 Enforce Access Controls for AI Agent Tools | Least privilege for agents and shared tools; tools act with the calling agent's identity and limits, so an agent cannot read more than its task needs |
| AML.M0036 Limit AI Workload Resource Consumption | Caps on iterations, tool calls, parallel tasks and delegation depth turn bulk sweeps into budget breaches that stop the run |
| AML.M0004 Limit AI Service Query Volume and Rate | Rate, burst and concurrency limits per identity on AI services and their back-end APIs |
| AML.M0005 Control Access to AI Models and Data at Rest | Restrict model registries and training data to approved users so collection tools cannot reach them |
| AML.M0030 Restrict AI Agent Tool Invocation on Untrusted Data | Limits tool use once untrusted content is in context, cutting off injected "gather everything" instructions |
| AML.M0039 AI Honeypots | Decoy datasets, documents or credentials that no legitimate workflow reads give a high-confidence collection alert |
| Data minimisation and labelling | Sensitivity labels and retention limits on chat histories and logs reduce what a sweep can gather |
How to test
- Pick a representative agent: one with file, search or database tools in a test tenant seeded with labelled synthetic data and a few decoy items.
- Run a broad-collection task: ask it, as a red team exercise (AML.M0035 AI Red Team), to gather all material matching a broad criterion, both directly and through content planted in a document it reads.
- Check enforcement: confirm tool-call budgets stop the run, permissions block out-of-scope repositories, and decoy access fires an alert.
- Check visibility: confirm the gateway, Purview or CloudTrail records show the agent identity, the resources read and the volume, and that the SIEM rule triggers.
- Roll back safely: introduce limits in alert-only mode first, review false positives for a few weeks against legitimate agents, then enforce.
Metrics
- Share of production agents with logged tool calls that include the agent identity.
- Share of agents with enforced tool-call and data-volume budgets.
- Median and 95th percentile resources read per agent task, tracked for drift.
- Coverage of data-plane logging on stores holding models, datasets and chat histories.
- Time from a decoy access or bulk-read alert to containment.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATLAS | AML.T0126 Automated Collection; tactic AML.TA0009 Collection; cases AML.CS0069, AML.CS0071 | The technique itself |
| MITRE ATT&CK | T1119 Automated Collection; T1213 Data from Information Repositories; T1530 Data from Cloud Storage | Enterprise mirror and common sources |
| NIST SP 800-53 Rev 5 | AC-6 Least Privilege, AU-12 Audit Record Generation, SI-4 System Monitoring | Agent data scope, data-plane logging, monitoring |
| NIST CSF 2.0 | PR.DS-01, DE.CM-03 | Protecting data at rest; monitoring technology usage |
| OWASP Top 10 for LLM Applications 2025 | LLM06:2025 Excessive Agency; LLM02:2025 Sensitive Information Disclosure | Agents with more data access than needed; disclosure of collected data |
Common failure patterns
- Data events left off. Object-level reads are not logged by default in CloudTrail, so bulk pulls of training data leave no trace.
- Agents sharing a human's full access. An assistant acting on behalf of a user can reach everything the user can, and the user often has far more than the task needs.
- No per-agent identity in logs. Collection by an agent appears as the user or as a shared service account, so it cannot be baselined.
- Chat histories and traces treated as low value. They accumulate credentials and personal data and are a ready-made collection target.
- Unauthenticated internal APIs. In AML.CS0071 user lists came from APIs that required no authentication; automation simply walked them.
Practitioner checklist
- Give every agent its own identity and log every tool call with it.
- Scope agent data access to the task, not to the invoking user's full rights.
- Set tool-call, parallelism and data-volume budgets per agent run.
- Enable data-plane logging on stores of models, datasets, embeddings and chat histories.
- Baseline resources read per agent and alert on drift.
- Place decoy documents and datasets where only a sweep would find them.
- Remove unauthenticated and debug APIs from production.
- Red team agents with broad-collection tasks after every permission change.
Standards and references
- MITRE ATLAS: Automated Collection (AML.T0126)
- MITRE ATLAS: GTG-1002 Claude Code Espionage Campaign (AML.CS0069)
- MITRE ATLAS: Multi-Agent Framework Compromises Taiwanese Government Systems (AML.CS0071)
- MITRE ATT&CK: Automated Collection (T1119)
- Taiwan Ministry of Digital Affairs: press release on AI agent assisted attacks (August 2026)
- Dream Research Labs: Inside a multi-agent AI framework used to compromise government entities in Asia
- Anthropic: Disrupting AI-orchestrated cyber espionage (GTG-1002 report)
- Microsoft Learn: Audit logs for Copilot and AI applications
Related NHI Mgmt Group resources: MITRE ATT&CK T1119 Automated Collection · MITRE ATLAS AML.T0086 Exfiltration via AI Agent Tool Invocation · MITRE ATLAS AML.T0035 AI Artifact Collection · MITRE ATLAS Guide