ATT&CK T1700 AI-Enabled Exfiltration: Detection Guide

AI-Enabled Exfiltration (T1700) is data theft carried out by your own AI assistant: an adversary plants instructions in a prompt, an email or a web page, and the agent uses the tools you granted it to move sensitive data to somewhere it should never go. MITRE added the technique to ATT&CK Enterprise in v20 under Exfiltration (TA0010), created on 22 September 2026, for the Windows and SaaS platforms. It is new enough that ATT&CK lists no procedure examples yet, but the building blocks are documented: hidden prompts in phishing email aimed at AI assistants, and indirect prompt injections already present on public web pages. This page covers what T1700 means for an enterprise SOC, the v20 detection strategy and its three analytics, the three v20 mitigations turned into agent identity and egress controls, and how to test. It is written for detection engineers, AI platform owners and identity teams who manage agent permissions.

Key takeaways

The agent is the insider. ATT&CK describes adversaries using direct or indirect prompt injection to make an enterprise AI agent use sanctioned tool connections for exfiltration, so the data leaves through an approved identity and an approved integration.
Detection is a three-step chain. v20 detection strategy DET0927 looks for an AI process or agent accessing data outside its authorised scope, then a transfer-capable action, then a destination outside the authorised list, within a defined window.
You must define "authorised" first. Every DET0927 analytic depends on tunable lists (AuthorizedAIDataScope, AuthorizedAIEndpoints, AuthorizedAIDataFlows); without them there is nothing to alert against.
Permissions are the main control. The v20 mitigations are restricting what data the agent can read (M1022), containing where it can send (M1048) and training users (M1017). An agent that cannot read a file cannot leak it.
Other exfiltration techniques still apply. ATT&CK notes the transfer itself often matches Exfiltration Over Web Service (T1567) or Exfiltration to Code Repository (T1567.001), so existing egress analytics remain useful.

What T1700 is in ATT&CK v20

ATT&CK v20 defines AI-Enabled Exfiltration as adversaries using Direct Prompt Injection (T1699), Indirect Prompt Injection (T1698) or other methods to instruct enterprise AI agents to exfiltrate data. When an agent processes a query or ingests content, an injected instruction can cause it to use its tool connections in unauthorised or unintended ways. The technique is version 1.0, has no sub-techniques, and covers two platforms: Windows (agents and assistants running as local processes) and SaaS (agents running inside cloud services and business applications).

Three things set T1700 apart from classic exfiltration:

No malware on the path. The process doing the transfer is a sanctioned AI application with a legitimate reason to call APIs, send messages or write files.
The trigger can be passive content. In the indirect case the adversary never talks to the agent; they leave instructions in an email, document, ticket or web page the agent later reads. Each injection technique has its own ATT&CK page and is covered there.
The identity is a non-human identity. The agent's service principal, OAuth grant or API key carries the permissions. Its scope is the blast radius.

ATLAS models the AI-system view of the same behaviour as Exfiltration via AI Agent Tool Invocation (AML.T0086). That page covers classifying agent write tools as exfiltration channels; this page stays with the enterprise SOC view in ATT&CK. See MITRE ATLAS AML.T0086 Exfiltration via AI Agent Tool Invocation.

How adversaries use it: documented evidence

ATT&CK v20 has no named group or software procedure for T1700 yet. The cases below come from vendor research cited by or relevant to the technique.

Source	What was observed	Defensive lesson
Barracuda, October 2026 (cited by ATT&CK)	Phishing emails carrying a hidden second layer of text that the human never sees but an AI email assistant reads; hiding methods included HTML comments, zero-size or white CSS text, Base64 content and zero-width Unicode characters. Listed goals included leaking data, marking the email as urgent and steering payments	Email is a direct injection path into any assistant that summarises or acts on mail; strip hidden content before it reaches the model
Barracuda, same research	A poisoned documentation page told a code assistant to insert a credential-exfiltration line into the authentication code it generated	Code assistants with web access can be steered into leaking secrets through the code they write; review generated code and block secret egress
Google, April 2026 (cited by ATT&CK)	A scan of Common Crawl found indirect prompt injections in categories including data exfiltration and destruction; exfiltration attempts were few and unsophisticated, but malicious detections rose by a relative 32% between November 2025 and February 2026	The technique is early but growing; build the controls before attacks are productionised

Common exfiltration channels an injected agent can be pushed to use, each needing its own control:

Send tools: email, chat or ticket replies to an external recipient.
Write tools: uploading to a file share, creating a public link, committing to a repository or creating a cloud storage object.
Fetch tools: requesting a URL with sensitive data in the query string, or rendering a markdown image whose URL carries data, a risk OWASP LLM05:2025 Improper Output Handling addresses through output encoding.
Connector actions: calling a SaaS API through an MCP server or plugin with data in the request body.

See the AI agent breaches page for incident patterns in agent deployments and the AML.T0051 LLM Prompt Injection page for the injection side.

What to detect and where

ATT&CK v20 detection strategy DET0927 (Detect AI-Enabled Exfiltration) has three analytics, one per platform.

Analytic	Platform	Chain to detect	Log sources named in v20
AN2078	SaaS	Agent accesses protected data, invokes a tool or API with that data or a derived payload, and the destination records a successful transfer to a recipient, repository, tenant, domain or service outside the authorised data flows	SaaS audit logs (the actual send, share, upload or write); AWS Bedrock agent trace fields actionGroupInvocationInput and knowledgeBaseLookupInput
AN2079	Windows	AI-associated process reads data outside its authorised scope, then transfer-capable execution and an outbound connection to an unauthorised destination from the same process lineage	Security 4656, 4663 and 4670 (object access); PowerShell 4103 to 4106; Sysmon 1
AN2080	Linux	Same chain as AN2079 on Linux hosts running agents	auditd open and read, EXECVE and connect syscalls

The tunable elements you need to build

v20 element	What to put in it	Where it comes from
AuthorizedAIDataScope / ProtectedDataScope	Data paths, sites, labels or classes each agent may read	Application design, IAM grants and data classification
AuthorizedAgentActions	Tools and functions each agent legitimately uses	Agent manifest or tool registry
AuthorizedAIDataFlows	Allowed source to tool to destination combinations	Workflow design reviews
AuthorizedAIEndpoints / AuthorizedAIOutputDestinations	Permitted model APIs, repositories, tenants, domains and recipients	Egress policy and connector configuration
ExpectedAIProcessTree	Normal parent and child processes for local AI apps	Clean executions in a test ring
EndpointExfilWindow / AIExfiltrationWindow	Normal time from data access to transfer	Baselines from clean workflows

Telemetry to switch on

Agent traces: for Amazon Bedrock Agents, set enableTrace on InvokeAgent so orchestration traces record each action group call (actionGroupName, apiPath, parameters, requestBody) and each knowledge base lookup. Equivalent tool call logs should be captured for any agent framework you run.
SaaS audit logs: send, share, external link creation and upload events, attributed to the agent's own identity rather than a shared integration account.
Object access auditing: on Windows, SACLs on sensitive folders so 4663 records the AI process reading them.
Egress logs: proxy or firewall records for AI processes and agent runtimes, so destinations can be compared with the authorised list.

High-value signals

An agent sending, sharing or uploading to an external domain it has never used before, within minutes of reading labelled data.
Tool call parameters or URLs containing long encoded strings, secrets patterns or document contents.
Agent output containing image or link markdown pointing at an external host with query parameters.
Processing of inbound content with hidden text (zero-size fonts, HTML comments, zero-width characters) shortly before an unusual agent action.

Mitigations: the v20 list as controls

Mitigation	ATT&CK v20 guidance	Practical control (NHI Mgmt Group recommendation)
M1022 Restrict File and Directory Permissions	Restrict file permissions to limit the exposure of sensitive data to AI agents	Give each agent its own identity with read access only to the sites, folders and labels its task needs; exclude highly confidential labels from agent and retrieval scope
M1048 Application Isolation and Sandboxing	Contain AI systems within the organisational network with no outside access	Egress allow-list per agent runtime; remove or gate generic URL fetch tools; disable external image rendering in agent output; run local agents in a sandbox with no general internet route
M1017 User Training	Train users on the implications of AI agent use within corporate environments	Teach users that summaries can be manipulated, and that requests to change payment details or share data must be confirmed outside the assistant

Further controls that break the chain

Human approval for outbound actions: require confirmation before an agent sends externally, shares a file outside the tenant or changes payment or vendor data. Barracuda recommends human approval for financial transactions and vendor changes.
Input sanitisation: remove hidden HTML, comments and invisible characters from email and web content before it reaches the model, and keep untrusted content separated from instructions.
Separate read and send: an agent that reads sensitive data should not hold a send-anywhere tool in the same session. Split them, or require approval when both are used.
Data loss prevention on agent output: apply DLP to agent messages and tool payloads as you would to user email. See the Generative AI Data Loss Prevention Guide.

Where identity fits

T1700 is an identity problem as much as a model problem. The agent acts through a non-human identity: a service principal, a delegated OAuth grant on behalf of a user, or an API key for a connector. Three identity choices decide the impact:

Delegated versus own identity: an agent acting with a user's full delegated permissions can read everything that user can. Prefer a dedicated agent identity with scoped permissions, or delegated scopes reduced to the task.
Write and send scopes: review OAuth grants for agents and connectors and remove mail send, file share and external sharing scopes that the workflow does not need.
Attribution: each agent needs its own identity in logs. A shared integration account makes AN2078 impossible to tune.

See the Agentic AI Identity Guide and, for response, the Investigating Agent-Initiated Data Exfiltration guide.

How to roll out and test

Inventory agents: list every assistant and agent, its identity, data scope, tools and possible destinations. This is the source for the v20 tunable lists.
Reduce scope first: cut data access (M1022) and outbound tools (M1048) before building detection; fewer permitted flows mean fewer false positives.
Turn on telemetry: agent traces, SaaS audit events and egress logs, attributed to each agent identity.
Build AN2078 in report-only mode for SaaS agents, then the endpoint analytics for local AI apps. Tune the windows from clean workflow baselines.
Test with authorised injection: in a test tenant, seed a document or email with a benign instruction to send a canary string to a controlled external address, and confirm the action is blocked or alerted. Use canary data, never real sensitive data.
Promote and review: move to alerting once the false positive rate is acceptable, and re-run the injection tests whenever an agent gains a new tool. Roll back to report-only if a new workflow floods the rule, and add that flow to the authorised list only after review.

Metrics

Agents with a defined data scope and destination list: percentage of inventory.
Agents holding external send or share tools: count, trending down.
Injection test block rate: percentage of seeded test injections blocked or alerted.
Agent actions to unauthorised destinations: count per month, each triaged.
Agent identities with delegated full user scope: count, trending down.

Common failure patterns

Treating the model as the control: relying on the model to refuse injected instructions instead of limiting what its identity can read and where it can send.
Agents on shared accounts: several agents behind one integration identity make data scope and attribution impossible.
Generic fetch and render left on: URL fetch tools and external image rendering provide an exfiltration path even when send tools are removed.
No list of authorised flows: DET0927 cannot work without AuthorizedAIDataFlows, so teams fall back on keyword rules that miss encoded data.
Delegated scopes copied from the user: the agent inherits mail send and file share rights it never needs.

Framework mapping

Framework	Reference	Relevance
MITRE ATT&CK v20	T1700, TA0010, DET0927 (AN2078 to AN2080)	Technique, tactic and detection analytics
MITRE ATT&CK v20	M1022, M1048, M1017	Mitigations listed for T1700
MITRE ATT&CK v20	T1698, T1699, T1567, T1567.001	Injection techniques and transfer channels (each has its own page)
MITRE ATLAS	AML.T0086, AML.T0051	AI-system view of agent tool exfiltration and prompt injection
OWASP Top 10 for LLM Applications 2025	LLM01:2025 Prompt Injection, LLM05:2025 Improper Output Handling, LLM06:2025 Excessive Agency	Injection, output rendering and over-permissioned tools
NIST SP 800-53 Rev 5	AC-4, AC-6, SC-7, SI-4	Information flow enforcement, least privilege, boundary protection, monitoring
NIST CSF 2.0	PR.AA-05, PR.DS-02, DE.CM-09	Least privilege permissions, data in transit, monitoring of software and runtime environments

Practitioner checklist

Inventory every AI agent with its identity, data scope, tools and destinations.
Give each agent its own identity and cut read scope to what the task needs.
Remove external send, share and generic fetch tools that are not required, and disable external image rendering in agent output.
Apply an egress allow-list to agent runtimes.
Require human approval for external sends, external sharing and payment or vendor changes.
Strip hidden content from email and web input before it reaches agents.
Enable agent trace and SaaS audit logging attributed to each agent identity.
Build the DET0927 chain with defined authorised data flows, and test it with canary injections.

MITRE ATT&CK T1700 AI-Enabled Exfiltration: Detecting Data Theft Through Enterprise AI Agents