Covert Unlogged Action — Directive to Hide an Action from Records or Detection
This detects text that instructs an AI agent to carry out an action and then explicitly conceal it — from audit logs, from oversight, or from the person affected. It targets prompt injection attempts that pair a normal-looking task with a covert instruction to make the action untraceable.
How the attack works
An attacker embeds a two-part instruction in content the agent processes: first a request to perform an action (administer a treatment, process a transaction, acquire data), then a directive to keep it out of official records, make it 'appear legitimate,' or ensure it goes 'undetected' by the system or the affected person. This pairing is designed to make an AI agent complete a task while actively undermining the audit trail meant to catch misuse. The rule looks specifically for concealment language (not recorded, not documented, not detected, appears legitimate) attached to an action, distinguishing it from ordinary requests to keep documentation accurate.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 4ddfd41a-1f54-4241-858d-e293e4fc12e5
- Severity
- High
Why it matters
If successful, an organization loses visibility into actions taken by its own AI agents — meaning fraudulent transactions, unauthorized medical actions, or unlogged data access could occur with no audit trail to detect or reverse them later.
What you can do
- →Review agent logs for instructions that ask both for an action and for its concealment; treat these as high-priority incidents, not routine requests.
- →Ensure agents cannot suppress, skip, or falsify their own audit/logging steps regardless of instructions embedded in input content.
- →Separate the logging/audit mechanism from the agent's control so a compromised or manipulated agent cannot disable its own record-keeping.
- →Distinguish legitimate confidentiality requests (restricting who can see a record) from concealment requests (hiding that the action happened at all) in your policies and training data.
Known benign look-alikes
- Legitimate 'ensure the records are accurate / ensure proper documentation / ensure protocols are followed' requests — these do not ask for concealment.
- Privacy directives to restrict access to authorized personnel (confidentiality) rather than to hide an action from the official record itself.
- Security research corpora cataloguing ASB attack strings as reference samples — should be allowlisted by a reviewer.