AML.T0086

MITRE ATLAS / ATLAS Techniques

Adversaries invoke agent tools capable of write operations to send data out, using an email, HTTP, file upload, or messaging tool as the exfiltration channel.

Think of it likeAsking the office runner to post a parcel for you, using the company's own postage account.

In plain English

Any agent tool that can send, upload, or write is an exit. The agent performs the transfer with its own credentials, so the outbound traffic looks like sanctioned automation.