Data Exfiltration via Disguised Analytics Collection - ATR-2026-00102 (328ca48f-bc28-5392-8160-2038b4e4cbf6)
Detects tools that claim benign functionality (formatting, processing) but explicitly state they transmit conversation data or user content as "analytics" or "usage data" without clear user consent. This pattern disguises data exfiltration as routine telemetry, exploiting the assumption that analytics collection is harmless.