T1682 Query Public AI Services Defensive Guide: What Public AI Services Teach Attackers About Your Organisation

Adversaries now ask public AI services to do their target research, turning everything your organisation and its people have published into a ready-made briefing on who to approach, how and with what story. MITRE ATT&CK T1682 Query Public AI Services, added in ATT&CK v20 under Reconnaissance (TA0043) on the PRE platform, describes adversaries querying publicly accessible AI services such as large language models to synthesise, aggregate and analyse public information at scale. The queries happen on a provider's platform, not yours, so you will not see them. What you control is the raw material: staff details, technology clues, partner relationships and leaked credentials that an AI service can assemble in seconds. This guide is for threat intelligence, security awareness, communications and identity teams, and draws on threat reports from AI providers. For the general reconnaissance programme, see the OSINT and Reconnaissance Guide.

Key takeaways

• AI does not create new exposure, it makes existing exposure cheap to use. ATT&CK frames T1682 as an addition to searching websites directly (T1593): the information was already public, and AI aggregates it at scale.
• Named groups do this today. ATT&CK records Kimsuky using LLMs to identify think tanks, government organisations and experts for spearphishing, and APT42 using them to find official email addresses and research business partners.
• Providers are the only party with direct visibility. Microsoft, Google and Anthropic report disabling the accounts involved; ATT&CK's detection guidance tells defenders to focus on later stages such as initial access.
• Pretexts are the output that matters. The research feeds believable approaches: fake recruiters, partner impersonation and tailored phishing. Process controls on payments, resets and hiring blunt it.
• Audit what an AI would say about you. Asking public AI services the questions an adversary would ask is a cheap, repeatable way to see your aggregated footprint.

What the technique covers

ATT&CK lists the purposes as identifying individuals or organisations to target, researching organisational structures and personnel, identifying technologies in use, researching business relationships to build pretexts for social engineering (T1684), finding contact information for phishing (T1566) and phishing for information (T1598), and gathering derogatory or sensitive information about individuals for extortion or coercion. The output often feeds Resource Development: generating lures and personas (T1683 Generate Content) and creating accounts (T1585 Establish Accounts). Gaining access to the AI tools themselves is a separate technique, T1588.007 Artificial Intelligence.

Cases from provider threat reports and ATT&CK

• Kimsuky (G0094): Microsoft and OpenAI reported in February 2024 that the actor Microsoft tracks as Emerald Sleet used LLMs to identify think tanks, government bodies and experts focused on North Korean defence issues, and to draft spearphishing content. Microsoft described the pattern as "LLM-informed reconnaissance" and stated that the accounts were disabled. See the Kimsuky Threat Actor Profile.
• Other actors in the same report: Microsoft described Salmon Typhoon running broad queries on intelligence agencies, notable individuals and geopolitics in a way that mirrored search engine use, and Charcoal Typhoon researching technologies, platforms and vulnerabilities.
• APT42 (G1044): Google Threat Intelligence Group (GTIG) reported in February 2026 that APT42 used Gemini to search for official email addresses of specific entities and to research potential business partners to build a credible pretext, and fed a target's biography in to craft a persona.
• Recruiter pretexts: the same GTIG report described the North Korean cluster UNC2970 using Gemini to synthesise open-source information on major cybersecurity and defence companies, map technical job roles and salary information, and support recruiter impersonation. GTIG noted this blurs the line between routine professional research and malicious reconnaissance.
• Research that became targeting: GTIG described UNC6418 using Gemini to seek account credentials and email addresses, then targeting those accounts in a phishing campaign focused on Ukraine and the defence sector.
• Agentic reconnaissance: Anthropic reported that GTG-1002, which it assessed with high confidence to be Chinese state-sponsored, used Claude Code to map target infrastructure and services across roughly 30 targets in 2025, with AI doing an estimated 80 to 90 percent of tactical work. See the Anthropic GTG-1002 campaign analysis. ATT&CK also lists the AI-Assisted Breach of Mexico's Government Infrastructure (C0064), in which the adversary used Claude Code and GPT-4.1 to conduct operations.

Providers also report the limits. Microsoft and OpenAI found no particularly novel AI-enabled techniques in 2024, and Anthropic reported that its model frequently overstated findings and occasionally fabricated data. The practical effect is speed and scale, not new access: the information still has to be public, and the approach still has to get past your processes.

What defenders can and cannot see

ATT&CK's detection strategy for T1682 (DET0919, analytic AN2062) states that much of this takes place outside the target's visibility and that detection efforts may focus on related stages such as initial access. Be honest about the split:

Reducing what AI services can assemble

ATT&CK lists only M1056 Pre-compromise, which includes auditing and sanitising public data such as job posts, websites and social media. The UK NCSC's phishing guidance makes the same point: limit what your website reveals, take extra care with high-profile staff, create a digital footprint policy for all users, and review what partners, contractors and suppliers publish about you. The controls below are NHI Mgmt Group recommendations built on that guidance.

• Role-based contact routes: publish shared mailboxes and web forms for press, sales and security contact rather than named individuals with predictable addresses.
• Job adverts without the blueprint: describe skills, not internal product versions, hostnames, cloud account structure or security tooling.
• Privileged roles out of the spotlight: avoid publicly linking named people to payment approval, identity administration or help desk authority.
• Partner publications: include case studies, logos and press releases in supplier agreements so partners do not publish architecture details about you.
• Public code and documents: scan public repositories, paste sites and document metadata for internal names and secrets. Any leaked key becomes trivial for an AI-assisted adversary to find and summarise.
• Executive and staff footprint: offer staff in exposed roles guidance on personal social media, in line with a written digital footprint policy.

Where identity fits

Two identity exposures matter most. First, the people: an aggregated view of who can reset accounts, approve payments or administer cloud tenants is exactly what an AI-assisted adversary produces, so help desk and payment processes must verify identity independently of anything public. See the Vishing and Help Desk Social Engineering Awareness Guide. Second, machine credentials: API keys, tokens and connection strings in public repositories or documentation are found and summarised in seconds. GTG-1002 showed harvested credentials being reused across internal services once access was gained. Scan for and revoke exposed secrets, and scope service accounts narrowly. See the MITRE ATT&CK T1589 Gather Victim Identity Information.

Running an AI-assisted footprint review

1. Set scope and rules: agree which public AI services may be used, that only public information is queried, and that no internal data is pasted into prompts. Use enterprise accounts where your policy requires them.
2. Ask the adversary's questions: who runs finance and identity administration, what email format staff use, what cloud and security tools you appear to run, who your key suppliers are.
3. Verify every answer: AI output contains errors and fabrications, so check each claim against its source before acting. Record the source page, not the AI answer.
4. Fix at source: edit or remove the web pages, adverts, repositories and partner content that produced the answer. Answers from AI services change only after sources change and models or indexes refresh.
5. Brief the exposed: tell staff whose roles are easily identified to expect targeted approaches, and give them a reporting route.
6. Repeat: quarterly, and after reorganisations, major announcements or hiring campaigns. Compare results with the previous review to show reduction.

Decision guidance

• Remove or accept: some exposure is a business need (investor relations, recruiting, sales). Remove details that help an attacker but not the reader, and protect necessary exposure with process controls such as call-back verification.
• Small organisations: focus on a role-based contact model, a short digital footprint policy and payment and reset verification. A one-off review takes a few hours.
• Large organisations: fold AI-assisted review into external attack surface and brand monitoring, and include subsidiaries and partners. See the Attack Surface Management Guide.
• Organisations in provider reports' target sectors: think tanks, defence, government, cryptocurrency and technology firms appear repeatedly in provider reporting, so prioritise staff briefings and verification for those roles.

Measurement

• Footprint findings: number of sensitive facts an AI-assisted review can confirm from public sources, tracked across reviews.
• Time to remediate: median days from a footprint finding to source removal or change.
• Exposed secrets: count of valid credentials found in public sources, and time to revoke.
• Targeted approach reports: staff reports of recruiter, partner or executive impersonation approaches, a leading indicator that research is being used.
• Verification adherence: share of payment changes and account resets completed with independent verification.

Common failure patterns

• Treating it as an AI problem: blocking AI services internally does nothing about adversaries using them externally; the fix is in your public footprint and processes.
• Named addresses everywhere: predictable email formats and named contacts for finance or IT support on public pages.
• Job adverts as architecture diagrams: listing exact product versions, internal system names and security tools.
• Trusting accurate detail: staff treating a message as genuine because it cites real projects, colleagues or partners, when that detail is now cheap to obtain.
• Pasting internal data into the review: running a footprint review by feeding internal documents into public AI services, creating the exposure you set out to measure.

Framework mapping

Practitioner checklist

• Run an AI-assisted footprint review using public information only, and verify every answer against its source.
• Replace named public contacts with role-based mailboxes and forms.
• Review job advert templates to remove internal system names, versions and security tooling.
• Write and publish a digital footprint policy, with extra guidance for executives and privileged roles.
• Scan public code, documents and paste sites for secrets and revoke anything found.
• Require independent verification for payment changes, account resets and recruiter or partner requests.
• Subscribe to AI provider threat reports and feed relevant patterns into awareness and detection.
• Repeat the review quarterly and after major announcements.

Standards and references

• MITRE ATT&CK: T1682 Query Public AI Services
• MITRE ATT&CK: M1056 Pre-compromise
• UK NCSC: Phishing attacks, defending your organisation
• Microsoft Security: Staying ahead of threat actors in the age of AI
• Google Threat Intelligence Group: AI Threat Tracker, distillation, experimentation and integration of AI for adversarial use
• Google Threat Intelligence Group: AI Threat Tracker, advances in threat actor usage of AI tools
• Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign

Related NHI Mgmt Group resources: OSINT and Reconnaissance Guide, MITRE ATT&CK T1598 Phishing for Information, AI-Generated Phishing Defence Guide, Social Engineering Guide. · MITRE ATT&CK T1593 Search Open Websites/Domains Guide