AML.T0136 Exfiltration via AI User Interface: How the Technique Works Against AI Systems and How to Defend

When an AI assistant can read sensitive data, its chat window, generated files and previews become an exfiltration channel that most data loss controls were never pointed at. MITRE ATLAS records this as AML.T0136 Exfiltration via AI User Interface, an Exfiltration (AML.TA0010) technique added in ATLAS 2026.10 (released 28 October 2026), rated Realized and listed for Predictive AI, Generative AI and Agentic AI. The adversary directs an AI system to present sensitive information in its responses or as downloadable artefacts, and the application's user interface carries the data out. This guide is for owners of enterprise AI assistants and agent platforms, data protection teams and detection engineers. It explains how the channel differs from API and tool-call exfiltration, the case ATLAS cites, and the logging, output and access controls that limit it. ATLAS maps no mitigation to T0136 as of release 2026.10, so the controls below are NHI Mgmt Group's mapping and are labelled that way.

Key takeaways

• The UI is the transfer channel. Conversational responses, generated documents, previews and downloads all count; ATLAS separates this from AML.T0024 (inference API) and AML.T0086 (agent tool invocation).
• It can carry two kinds of data. ATLAS names Data from AI Services (AML.T0085) and Outputs from AI Models (AML.T0135) as what moves through the interface.
• A state-sponsored campaign used it. In the GTG-1002 campaign, human operators approved the transfer of selected data over the Claude web service after an agent had collected and summarised it.
• The assistant's reach sets the blast radius. Whatever an assistant can retrieve on a user's behalf can be presented in its interface; least privilege on connectors and agent identities is the primary control.
• Log what the interface showed. Without response and artefact logs tied to identity, a UI exfiltration leaves almost no trace in conventional network telemetry.

What the technique is

ATLAS defines Exfiltration via AI User Interface as adversaries exfiltrating information through an AI system's user-facing outputs. Information may be disclosed in conversational responses, generated documents, previews or other content presented through the application. The application may expose information available to an AI service the adversary controls, or deliver information gathered from other victim systems. Adversaries may direct the AI system to present sensitive information in responses or as downloadable artefacts, so the user interface serves as the transfer channel.

Two situations follow from that definition. In the first, an adversary with access to a victim's AI assistant (a compromised account, a malicious insider, a shared session) asks it to gather and present data the assistant can reach. In the second, the adversary runs its own AI service against victim systems and reads the results in that service's interface, as in the case below. In both, the data leaves as screen content or a file download, not as an obvious upload to an unknown host.

How it differs from neighbouring techniques

The data being moved often comes from AML.T0085 Data from AI Services, whose sub-technique AML.T0085.002 Conversation Context and Memory absorbed the retired AML.T0057 LLM Data Leakage in ATLAS 2026.10. The AI-application view of that leakage risk is covered in the OWASP LLM Top 10 LLM02 Sensitive Information Disclosure Guide.

How it has been used: the GTG-1002 case

ATLAS links T0136 to one case study, AML.CS0069 GTG-1002 Claude Code Espionage Campaign. In September 2025 a group Anthropic assessed with high confidence to be Chinese state-sponsored used a jailbroken Claude Code agent against about 30 organisations in technology, finance, chemical manufacturing and government, succeeding against a small number. The agent was connected to scanners, browser automation, password crackers and database tooling through MCP. After gaining access it found authentication certificates in configuration files, used harvested credentials against other services, and collected data from local systems and internal databases.

The agent performed an estimated 80 to 90 percent of the work, including categorising collected data by intelligence value. Operators kept about four to six critical decisions per target, among them reviewing a summary and approving the transfer of selected data over the Claude web service. That approval step is the T0136 element: the adversary's own AI interface was the place where victim data was presented and taken. MITRE ATT&CK tracks the same operation as campaign C0062. NHI Mgmt Group's analysis of the incident, including the credential lessons, is at Anthropic GTG-1002 Campaign 2025.

The lesson for defenders of the victim side is that the exfiltration channel was invisible to them: it ran inside an AI provider's service. Their realistic controls were earlier in the chain, on secrets in configuration files, credential scope and machine-speed activity.

Where identity fits

An enterprise assistant answers with the permissions of the identity it runs as. If it uses a broad service account or a connector token with tenant-wide read, any user who can talk to it, or anyone who has stolen that user's session, can ask it to present data the user could never browse directly. Scope connector tokens and agent identities to the data each use case needs, prefer acting on behalf of the signed-in user so existing permissions apply, and review those grants like any other non-human identity. See AML.T0012 Valid Accounts for the access side and the Claude Code Security Guide for one agent platform's customer-side settings.

Detection and measurement

Metrics:

• Coverage: share of AI assistants and agent platforms whose prompts, responses and artefacts are logged and retained.
• Label-aware responses: share of responses where source sensitivity labels were evaluated before display.
• Connector scope: number of connector or agent tokens with tenant-wide read, trending to zero.
• Alert triage time: median time to review a bulk-retrieval alert from an AI application.
• Blocked or redacted outputs: volume and false-positive rate of output filtering.

Controls and how to implement them

None of these are mapped to T0136 by ATLAS 2026.10; they are the controls that act on the channel ATLAS describes.

1. Inventory: list every AI assistant, copilot and agent platform, the identity each runs as, and the data stores each connector can read.
2. Cut reach: remove tenant-wide connector grants, move to on-behalf-of access where the platform supports it, and exclude restricted stores from general assistants.
3. Log: turn on prompt, response and artefact logging with identity and source references; set retention with your privacy team.
4. Filter in audit mode: deploy output detection for credentials, personal data and labelled content in report-only mode for two to four weeks, measure false positives, then switch high-confidence rules to block or redact. Keep the ability to return a rule to audit mode if it disrupts work.
5. Control artefacts: apply existing data loss prevention rules to files the assistant generates and to download events (see the Generative AI Data Loss Prevention Guide).
6. Detect and respond: add the alerts above to the SOC, and include AI application logs in exfiltration investigations (see Investigating Agent-Initiated Data Exfiltration).

Choosing where to invest: a small organisation using one SaaS assistant gets most value from steps 1, 2 and 3 using the vendor's own admin settings. A large organisation running its own agents and RAG applications needs label-aware retrieval and output filtering in its own gateway, because the platform will not know its data classification.

Common failure patterns

• DLP on email and web only: generated documents and chat responses are not inspected, so the same data that would be blocked as an attachment leaves as a summary.
• Assistant runs as a super-user: one service identity with broad read turns every user into a privileged reader.
• No response logging: prompts are logged but responses and artefacts are not, so investigators cannot see what was shown.
• Relying on system prompt rules: OWASP LLM02:2025 notes that instructions limiting what data types the model returns may not be honoured and can be bypassed by prompt injection or other methods.
• Credentials in readable configuration: in GTG-1002 the agent found certificates in configuration files; anything an agent can read can be summarised and presented.

Framework mapping

The conventional technique is covered in T1567 Exfiltration Over Web Service.

Practitioner checklist

• List every AI assistant and agent platform with its identity and connector scopes.
• Remove tenant-wide read grants from assistant and connector identities.
• Log prompts, responses, retrieved sources and generated artefacts with user identity.
• Apply output filtering for credentials, personal data and labelled content.
• Extend data loss prevention to generated files and download events.
• Keep restricted data stores out of general-purpose assistants.
• Remove secrets from configuration files that agents can read.
• Add AI application logs to exfiltration investigation runbooks.

Standards and references

• MITRE ATLAS: Exfiltration via AI User Interface
• MITRE ATLAS: GTG-1002 Claude Code Espionage Campaign (case study)
• MITRE ATT&CK: Anthropic AI-orchestrated Campaign (C0062)
• OWASP: LLM02:2025 Sensitive Information Disclosure
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls
• Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign

Related NHI Mgmt Group resources: MITRE ATLAS Guide · Generative AI Data Loss Prevention Guide · MITRE ATLAS AML.T0086 Exfiltration via AI Agent Tool Invocation · Data Exfiltration Guide · MITRE ATLAS Mitigations Guide