Threat intelligence / Technique
RAG Credential Harvesting
Adversaries may attempt to use their access to a large language model (LLM) on the victim's system to collect credentials. Credentials may be stored in internal documents which can inadvertently be ingested into a RAG database, where they can ultimately be retrieved by an AI agent.
Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14
Confidence
—
Adversaries may attempt to use their access to a large language model (LLM) on the victim's system to collect credentials. Credentials may be stored in internal documents which can inadvertently be ingested into a RAG database, where they can ultimately be retrieved by an AI agent.
3 recorded
Relationships
1 external