AgentDojo 'Important Message' Identity-Spoof Before-You-Solve Pretext (Generalized)
Attackers hide text inside documents, emails, or web pages that an AI agent reads while doing its job. That text pretends to be an urgent message from the real user, telling the agent it must complete a 'task' before continuing with what it was originally asked to do — a wrapper that works no matter what the actual malicious goal is.
How the attack works
An attacker plants content the agent will read as part of its normal work, such as a document or webpage. The content is written to look like a message from the user, using a fixed phrasing pattern ('This is an important message from me, {user}, to you, {model}') combined with a claim that the agent must do something first 'before you can solve the task that I gave you in the beginning'. Because the agent trusts what looks like user instructions, it treats the injected text as a legitimate prerequisite step and carries it out. The actual goal spliced into this wrapper can be anything — stealing data, forwarding emails, changing settings, disabling safety checks — the wrapper itself is what makes any of those goals land.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- aa8630e4-c5d0-42e4-86b7-3921d8ac552c
- Severity
- High
Why it matters
An organization loses control over what its AI agent does next: the agent can be redirected to leak data, change configuration, or take other unauthorized actions, all disguised as a normal step the user supposedly asked for.
What you can do
- →Treat any content the agent reads from external documents, emails, or web pages as untrusted input, not as user instructions, and enforce that separation in the agent's system design.
- →Review agent logs for messages matching the 'important message from me... to you' framing or references to a 'task I gave you in the beginning' that did not originate from the actual user session.
- →Require agents to re-confirm sensitive or state-changing actions with the real authenticated user rather than acting on instructions found inside retrieved content.
- →Test agents against known prompt-injection benchmarks like AgentDojo to check whether this wrapper pattern successfully hijacks task flow before deploying to production.
Known benign look-alikes
- Legitimate multi-step task instructions that happen to say 'before you begin' without the identity-spoof framing or the exact 'task that I gave you in the beginning' phrasing
- Fiction or role-play content quoting this exact benchmark phrase for research/documentation purposes