title: Injected Code — Local File Exfiltration to a Remote Endpoint
id: ATR-2026-01890
rule_version: 1
status: experimental
description: 'Detects indirect-injection payloads (BIPIA code class) that coerce the agent to embed a code snippet which reads a local file and ships its raw bytes to an attacker-controlled endpoint via HTTP POST, FTP STOR, raw socket, or Bluetooth. Invariant: a local read (open()/.read()/.tobytes()/r.content) bound to a remote sink in the same statement.'
author: ATR Community
date: 2026/06/13
schema_version: '0.1'
detection_tier: pattern
maturity: stable
severity: high
references:
  owasp_llm:
    - LLM02:2025
    - LLM05:2025
  owasp_agentic:
    - ASI01:2026
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
    - AML.T0057 - LLM Data Leakage
compliance:
  owasp_llm:
    - id: LLM02:2025
      context: Primary OWASP LLM mapping for this indirect-injection payload class.
      strength: primary
  owasp_agentic:
    - id: ASI01:2026
      context: Injected instructions inside untrusted data hijack the agent's goal toward an attacker-controlled output.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: Article 15 robustness requires resistance to adversarial manipulation of AI output; this rule is a runtime detection control for the pattern.
      strength: primary
    - article: '9'
      context: Article 9 risk management catalogues this attack pattern with a runtime control.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: 'MEASURE 2.7 security/resilience evaluation: this rule surfaces the pattern for measurement.'
      strength: primary
    - subcategory: MG.2.3
      context: 'MANAGE 2.3 response to identified risks: runtime detection control.'
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 8.1 operational control includes monitoring processed data for embedded attack payloads.
      strength: primary
tags:
  category: context-exfiltration
  subcategory: file-exfiltration
  scan_target: llm_io
  confidence: high
  corpus_source: bipia
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  method: pattern
  conditions:
    - field: user_input
      operator: regex
      value: (?i)requests\.post\([\s\S]{0,80}\bdata\s*=\s*\w+\.(?:read|tobytes)\(\)
      description: 'BIPIA file-exfiltration invariant #1'
    - field: user_input
      operator: regex
      value: (?i)requests\.post\([\s\S]{0,80}\bfiles\s*=\s*\{[\s\S]{0,80}(?:open\(|\.content)
      description: 'BIPIA file-exfiltration invariant #2'
    - field: user_input
      operator: regex
      value: (?i)\b(?:storbinary|sendall)\([^\n]{0,40}(?:\.content|\.read\(\)|\bdata\b|open\()
      description: 'BIPIA file-exfiltration invariant #3'
    - field: user_input
      operator: regex
      value: (?i)\bconn\.request\(\s*[\"']POST[\"'][^\n]{0,40}\.read\(\)
      description: 'BIPIA file-exfiltration invariant #4'
    - field: user_input
      operator: regex
      value: (?i)\bbt_sock\.send\(\s*r\.content\s*\)
      description: 'BIPIA file-exfiltration invariant #5'
  condition: any
  false_positives:
    - Security documentation, papers, or test suites that describe this attack technique without executing it.
    - Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.
response:
  actions:
    - alert
    - block_tool
  auto_response_threshold: high
  message_template: '[ATR-2026-01890] Injected Code — Local File Exfiltration to a Remote Endpoint detected (BIPIA file-exfiltration).'