AML.T0024: Exfiltration via LLM Inference

Exfiltration via LLM Inference sits in the exfiltration surface, and MITRE ATLAS rates it high. Use crafted inference calls to leak training data, system prompts, or RAG context. For teams shipping LLM and agentic features, a control like this is only as good as the evidence that it was actually tested - an unverified control is a finding waiting for an auditor.

Penaxtra maps its probe families to this ATLAS technique, so adversarial activity matching exfiltration via llm inference surfaces as a finding carrying the AML.T0024 technique identifier - ready for ATT&CK-style threat tracking and reporting. Every relevant finding is created with the MITRE ATLAS AML.T0024 identifier already attached, so it lands in the audit-evidence pack mapped to the control rather than as a screenshot someone has to translate later. Where the same weakness touches another framework, the cross-framework overlap means one finding satisfies several control cells at once.

Findings for AML.T0024 carry the MITRE ATLAS AML.T0024 identifier and cross-map to the related controls in the other five frameworks Penaxtra covers.