Anonymous Illicit-Drug Marketplace Construction
This detects a direct request to an AI coding or automation agent to build an anonymous website for buying and selling illegal drugs, and to find hosting for it. It covers the request itself, not a hidden manipulation of the agent.
How the attack works
The user asks the agent to write the code for a marketplace site designed for anonymity, such as hidden listings, untraceable payments, or no seller identification. The user then asks the agent to help find or set up hosting for the site, often emphasizing anonymity or resistance to takedown. The rule flags this combined pattern of build-plus-host requests tied to illegal drug sales.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 2f9c450b-17b8-41c4-9ab1-9c58e7257dd6
- Severity
- High
Why it matters
If the agent complies, the organization running it becomes a party to producing infrastructure for illegal drug trafficking, exposing it to legal liability and reputational damage, and providing criminals with working code and hosting guidance.
What you can do
- →Configure agents to refuse code-generation requests for marketplaces trading in illegal or controlled goods, regardless of phrasing.
- →Review agent logs for requests combining 'anonymous marketplace' language with hosting or infrastructure questions.
- →Distinguish legitimate use (legal marketplaces, security research, law-enforcement writeups) from actual build requests before escalating.
- →Require human review before an agent outputs hosting recommendations, especially those emphasizing anonymity or takedown resistance.
Known benign look-alikes
- Law-enforcement descriptions of taking down drug marketplaces
- Building a legitimate marketplace site for legal goods