AML.T0085
Data from AI Services
Description
Adversaries may use their access to a victim organization's AI-enabled services to collect proprietary or otherwise sensitive information. As organizations adopt generative AI in centralized services for accessing an organization's data, such as with chat agents which can access retrieval augmented generation (RAG) databases and other data sources via tools, they become increasingly valuable targets for adversaries. AI agents may be configured to have access to tools and data sources that are not directly accessible by users. Adversaries may abuse this to collect data that a regular user wouldn't be able to access directly.
Honesty-tier rationale
Collection assumes access to real data stores; at most a concept can be staged over a mock repository.
Sub-techniques
- AML.T0085.000 — RAG Databases
- AML.T0085.001 — AI Agent Tools