BOLA Cross-User Data Access Attempt (Semantic)
An attacker asks an AI agent for records that belong to someone else, without naming a specific user directly. Instead of saying whose data they want, they phrase it as a generic query, like 'find the account with the highest balance,' hoping the agent will fetch it without checking who is allowed to see it.
How the attack works
The attacker sends the agent a request that looks like an ordinary query rather than an obvious cross-user lookup. The phrasing avoids naming another user explicitly but instead references an object indirectly, such as by balance size, transaction count, or a specific account number. If the agent's backend does not verify that the requester actually owns the record being fetched, it returns another user's data. This differs from role-based bypass attempts because it targets a specific object reference rather than a permission level.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 4c44ce3c-11f3-4d33-ba6f-eebaff5abdf3
- Severity
- High
Why it matters
An organization can leak individual users' financial or personal records to unauthorized requesters, one account at a time, without any obvious authorization error being triggered.
What you can do
- →Enforce object-level ownership checks on every data fetch, not just role checks.
- →Reject or flag agent queries that reference records by attributes (balance, count, ID) instead of the requester's own identity.
- →Log and review cases where an agent fetches records not tied to the authenticated user's ID.
- →Exclude known legitimate cases, such as analytics agents or admins with explicit cross-account read rights, from alerting to reduce noise.
Known benign look-alikes
- Authorized analytics agents querying aggregate data across all users
- Admin users with explicit cross-account read permissions