H3XA — Operational Evidence

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may exfiltrate AI artifacts or other information relevant to their goals via traditional cyber means. See the ATT&CK [Exfiltration](https://attack.mitre.org/tactics/TA0010/) tactic for more information.

12 recorded

Relationships

mitigates

from Control Access to AI Models and Data at Rest

Mitigation

uses

from Arbitrary Code Execution with Google Colab

Campaign

uses

from Compromised PyTorch Dependency Chain

Campaign

uses

from EchoLeak: Zero-Click Prompt Injection Targeting M365 Copilot for Data Exfiltration

Campaign

uses

from Exposed ClawdBot Control Interfaces Leads to Credential Access and Execution

Campaign

uses

from Google Photos AI Model Extraction

Campaign

uses

from LAMEHUG: Malware Leveraging Dynamic AI-Generated Commands

Campaign

uses

from Malware Prototype with Embedded Prompt Injection

Campaign

uses

from Microsoft Azure Service Disruption

Campaign

uses

from Organization Confusion on Hugging Face

Campaign

uses

from Prompt-Based Attacks Against Gemini via Calendar Invitations

Campaign

uses

from ShadowRay: Hijacking Exposed Ray Clusters

Campaign

1 external

References

mitre-atlas

AML.T0025

open