Top AI 2026 | MITRE ATLAS Mapped AML.T0035 – Bulk Collection of AI Models & Datasets Pre-Exfiltration (AML-DET-019)

Ibrahim Saud@tektrix

•updated Sep 25, 2026•0•0•2

Detects a sequence of potentially malicious activity involving the bulk reading or downloading of sensitive AI-related artifacts (model files, datasets), followed by the staging of these files into a compressed archive, and finally an outbound network transfer to an external IP address. This behavior pattern is indicative of data exfiltration of intellectual property.