Threat intelligence / Technique

Activation Triggers

Adversaries may discover keywords or other triggers (such as incoming emails, documents being added, incoming message, or other workflows) that activate an agent and may cause it to run additional actions. Understanding these triggers can reveal how the AI agent is activated and controlled. This may also expose additional paths for compromise, as an adversary could attempt to trigger the agent from outside its environment and drive it to perform unintended or malicious actions.

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may discover keywords or other triggers (such as incoming emails, documents being added, incoming message, or other workflows) that activate an agent and may cause it to run additional actions. Understanding these triggers can reveal how the AI agent is activated and controlled. This may also expose additional paths for compromise, as an adversary could attempt to trigger the agent from outside its environment and drive it to perform unintended or malicious actions.

4 recorded

Relationships

mitigates

from Limit Public Release of Information

Mitigation

subtechnique-of

to Discover AI Agent Configuration

Technique

uses

from Claude Code GitHub Action Secret Exposure

Campaign

uses

from Data Exfiltration via Agent Tools in Copilot Studio

Campaign

1 external

References

mitre-atlas

AML.T0084.002