Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Incident overview
Researchers at Lumia have demonstrated that it is possible to extract authentication tokens from the memory of LLM Desktop Applications. An attacker could then use those tokens to impersonate the victim to the LLM backend, thereby gaining access to the victim's conversations as well as the ability to interfere in future conversations. The attacker's access would allow them the ability to directly inject prompts to change the LLM's behavior, poison the LLM's context to have persistent effects, manipulate the user's conversation history to cover their tracks, and ultimately impact the confidentiality, integrity, and availability of the system.
The researchers demonstrated this on Anthropic Claude, Microsoft M365 Copilot, and OpenAI ChatGPT.
Vendor Responses to Responsible Disclosure: - Anthropic (HackerOne) - Closed as informational since local attack. - Microsoft Security Response Center - Attack doesn't bypass security boundaries for CVE. - OpenAI (BugCrowd) - Closed as informational and noted that it's up to Microsoft to patch this behavior.
Why this record has no ERS
MITRE ATLAS AML.CS0036 describes one attacker technique (scraping a session token from the process memory of a desktop LLM client after the attacker already has access to the victim's machine, then replaying it to the vendor backend) demonstrated on three independent vendor products with different client implementations, backends, downstream reach, and disclosure outcomes. The record gives no per-product evidence and generalises the key behaviour only to many applications, so it establishes neither one bounded system nor one representative configuration class. The record fails the boundary test and multiplicity rule of the scorability admission test.
Status: Not scorable by design · Classification: Validated Research · source date 2026-08-06 · primary evidence date 2025-01-01
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The flow documents what happened and which controls apply; it does not establish an assessed deployment.
| MITRE ATLAS case study | AML.CS0036 (exercise) |
|---|---|
| Target | LLM Desktop Applications (Claude, ChatGPT, Copilot) |
| Actor | Lumia Security |
| Primary evidence date | 2025-01-01 |
| SecureFlow record updated | 2026-08-06 |
| AI layers | Edge and client AI |
| Risk impact | Credential and identity theft, Model poisoning / integrity |
| Affected components | LLM desktop applications, desktop client authentication tokens, LLM backend service, conversation history and memory state |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Gain Initial Access to Victim SystemThe attacker required initial access to the victim system to carry out this attack. | AML.TA0004 AML.T0012 |
| 2 | Enumerate LLM Desktop Application ProcessesThe attacker enumerated all of the processes running on the victim's machine and identified the processes belonging to LLM desktop applications. | AML.TA0008 AML.T0089 |
| 3 | Extract Desktop LLM Authentication Token from Process MemoryThe attacker attached or read memory directly from `/proc` (in Linux) or opened a handle to the LLM application's process (in Windows). The attacker then scanned the process's memory to extract the authentication token of the victim. This can be easily done by running a regex on every allocated memory page in the process. | AML.TA0013 AML.T0090 |
| 4 | Replay Extracted Token Against LLM BackendThe attacker used the extracted token to authenticate themselves with the LLM backend service. | AML.TA0015 AML.T0091.000 |
| 5 | Impersonate Desktop Client to Access LLM ServiceThe attacker has now obtained the access required to communicate with the LLM backend service as if they were the desktop client. This allowed them access to everything the user can do with the desktop application. | AML.TA0000 AML.T0047 |
| 6 | Inject Prompts into Ongoing ConversationsThe attacker sent malicious prompts directly to the LLM under any ongoing conversation the victim has. | AML.TA0005 AML.T0051.000 |
| 7 | Poison Active Chat Thread ContextThe attacker could craft malicious prompts that manipulate the context of a chat thread, an effect that would persist for the duration of the thread. | AML.TA0006 AML.T0080.001 |
| 8 | Poison Persistent LLM MemoryThe attacker could then craft malicious prompts that manipulate the LLM's memory to achieve a persistent effect. Any change in memory would also propagate to any new chat threads. | AML.TA0006 AML.T0080.000 |
| 9 | Manipulate Conversation History to Hide ActivityMany LLM desktop applications do not show the injected prompt for any ongoing chat, as they update chat history only once when initially opening it. This gave the attacker the opportunity to cover their tracks by manipulating the user's conversation history directly via the LLM's API. The attacker could also overwrite or delete messages to prevent detection of their actions. | AML.TA0007 AML.T0092 |
| 10 | Increase Victim Cost Through Spam PromptsThe attacker could send spam messages while impersonating the victim. On a pay-per-token or action plans, this could increase the financial burden on the victim. | AML.TA0011 AML.T0048.000 |
| 11 | Access Victim Conversations and Uploaded ContentThe attacker could gain access to all of the victim's activity with the LLM, including previous and ongoing chats, as well as any file or content uploaded to them. | AML.TA0011 AML.T0048.003 |
| 12 | Delete Victim Chats to Deny LLM AccessThe attacker could delete all chats the victim has, and any they are opening, thereby preventing the victim from being able to interact with the LLM. | AML.TA0011 AML.T0029 |
| 13 | Spam Prompts to Trigger Rate-Limit BanThe attacker could spam messages or prompts to reach the LLM's rate-limits against bots, to cause it to ban the victim altogether. | AML.TA0011 AML.T0029 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0036-aikatz-attacking-llm-desktop-applications; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0036 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-028.005 | Client Request, Cache & Application-State Lifecycle SecurityExact SecureFlow defense-map identifier (flow atlas-aml-cs0036-aikatz-attacking-llm-desktop-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-7 |
| AID-H-028.002 | Client Credential Secure Storage & Lifecycle ManagementExact SecureFlow defense-map identifier (flow atlas-aml-cs0036-aikatz-attacking-llm-desktop-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-7 |
| AID-D-001.001 | Per-Prompt Content, Intent & Obfuscation AnalysisExact SecureFlow defense-map identifier (flow atlas-aml-cs0036-aikatz-attacking-llm-desktop-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-D-003.005 | Stateful Session Monitoring: Intent Drift + Invariant-Breach SignalsExact SecureFlow defense-map identifier (flow atlas-aml-cs0036-aikatz-attacking-llm-desktop-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-3 Cn-1 Cn-3 Cn-7 |
| AID-D-003.006 | Memory Write-Abuse & Drift MonitoringExact SecureFlow defense-map identifier (flow atlas-aml-cs0036-aikatz-attacking-llm-desktop-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-8. Presence supplies no score credit. | Candidate evidence route | Ro-3 Cn-1 Cn-3 Cn-7 |
| AID-I-004.004 | Transactional Promotion Gates (Quarantine -> Trusted)Exact SecureFlow defense-map identifier (flow atlas-aml-cs0036-aikatz-attacking-llm-desktop-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-8. Presence supplies no score credit. | Candidate evidence route | Pr-2 Pr-4 Cn-4 Cn-7 Cn-8 Cn-9 |
| AID-D-001.005 | Recalled Memory Pre-Rehydration ScanningExact SecureFlow defense-map identifier (flow atlas-aml-cs0036-aikatz-attacking-llm-desktop-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-8. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-E-005 | Compromised Durable Application Session & Agent State TeardownExact SecureFlow defense-map identifier (flow atlas-aml-cs0036-aikatz-attacking-llm-desktop-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-9. Presence supplies no score credit. | Candidate evidence route | Pr-3 Cn-9 |
| AID-D-005.007 | Token, Tool-Use, Request-Parameter & Cost Spike Detection & AlertingExact SecureFlow defense-map identifier (flow atlas-aml-cs0036-aikatz-attacking-llm-desktop-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-10, step-13. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
| AID-I-003.003 | Resource, Token & Spend Budget ThrottlingExact SecureFlow defense-map identifier (flow atlas-aml-cs0036-aikatz-attacking-llm-desktop-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-10. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-6 Cn-7 |
| AID-E-001.002 | Issued Token, Authentication Session & Lease RevocationExact SecureFlow defense-map identifier (flow atlas-aml-cs0036-aikatz-attacking-llm-desktop-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-11. Presence supplies no score credit. | Candidate evidence route | Cn-5 |
| AID-H-018.003 | High-Impact Independent Validation & Approval GateExact SecureFlow defense-map identifier (flow atlas-aml-cs0036-aikatz-attacking-llm-desktop-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-12. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-I-003.002 | Identity, Session & API Rate-Limit ThrottlingExact SecureFlow defense-map identifier (flow atlas-aml-cs0036-aikatz-attacking-llm-desktop-applications), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-13. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-6 Cn-7 |