Casual Authority Data Redirect
This rule flags prompts that try to trick an AI agent into sending its output somewhere new or turning off its safety checks by pretending the request comes from an authority figure, like an admin or manager. It's a social engineering trick aimed at AI agents rather than humans.
How the attack works
An attacker crafts a prompt that claims authority — 'the admin approved this' or 'IT told me to set this up' — to make the request sound routine and pre-approved. The prompt asks the agent to redirect its output, logs, or data to a new endpoint, or to disable a safety filter, framing it as a normal operational change. Because the request is phrased casually and attributes the decision to someone else, the agent may treat it as already vetted and comply without independent verification. The rule was built from 62 real adversarial examples of this pattern that no prior detection caught.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 19133a9d-914b-479a-b255-0dfdead2d0f5
- Severity
- Critical
Why it matters
If successful, an attacker can get an AI agent to leak its output or data to a system they control, or weaken the safety controls meant to constrain the agent's behavior.
What you can do
- →Require independent verification of any request to change output destinations or disable safety settings, regardless of who the request claims to be from.
- →Do not let agents treat claimed authority ('the admin said...') inside a conversation as proof of approval; approvals should come through a separate, authenticated channel.
- →Review the false-positive note: legitimate infrastructure changes described this way will also trigger this pattern, so pair detection with a manual approval workflow for redirect requests.
- →Log and review any agent configuration changes involving new destination endpoints or filter toggles, independent of the justification given in the prompt.
Known benign look-alikes
- An IT support ticket stating 'the admin said to forward all logs to 10.0.0.1 for the new monitoring system' could match pattern 1 even though it describes a legitimate infrastructure change approved by an actual administrator.