Advanced Structured Data Injection with Nested Payloads
Attackers bury malicious instructions inside complex, deeply nested structured data — JSON objects, multi-level CSV, or serialized formats — so that security filters skim past them but the AI model still reads and obeys them. The trick works because scanners and the target LLM often parse the same data differently.
How the attack works
An attacker crafts a data payload (JSON, CSV, or another serialization format) that looks like normal structured input at the top level. The actual malicious instruction is buried several layers deep, inside nested fields, arrays, or encoded values that a validation layer may skip or normalize incorrectly. When the AI agent processes the full structure, it reaches and executes the injected instruction even though upstream schema checks passed. This exploits the gap between how a validator parses the data and how the LLM interprets it.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 0b5052b6-c7e3-452b-ab07-e51d7668163c
- Severity
- Critical
Why it matters
An organization's schema and content filters can be bypassed, letting attacker instructions reach the model and potentially trigger unauthorized actions, data leaks, or changed agent behavior.
What you can do
- →Apply the same parser and depth limits to security scanning as the LLM actually uses, rather than a simplified validator.
- →Flatten or cap the nesting depth of structured input before it reaches the model, and reject inputs exceeding reasonable limits.
- →Review flagged deeply nested payloads manually before assuming they are malicious, since legitimate config templates and logs can trigger similar patterns.
- →Log and audit cases where structured data contains embedded instruction-like keywords (e.g. 'override', 'system') even in field names, to catch smuggling attempts early.
Known benign look-alikes
- Legitimate deeply nested JSON payloads with coincidental keyword matches
- A configuration management tool sending deeply nested JSON templates that contain field names like 'override_previous_config' as legitimate key names in deployment automation
- Log aggregation systems forwarding raw error messages containing escaped newline sequences followed by the word 'system' in legitimate stack traces