Data Piggybacking via Casual Transition Words
Attackers hide malicious instructions inside a tool's response by tacking them on after casual phrases like 'oh and', 'BTW', or 'as it happens'. Because these phrases sound like normal human chatter, an AI agent reading the response may treat the hidden instruction as a natural continuation and act on it, such as sending along credentials.
How the attack works
An AI agent calls a tool (like a search, document reader, or API) and gets back a response that looks legitimate. Buried after the real content is a casual transition phrase, followed by an instruction such as asking the agent to reveal or forward credentials, API keys, or secrets. The agent's language model can fail to distinguish this appended text from genuine tool output and complies with the hidden request. This rule extends an earlier detection to cover 44 more phrasing variants attackers use to evade filters.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- b9ae101d-c4c6-4a57-8097-571fc609551f
- Severity
- Critical
Why it matters
An organisation can lose credentials, API keys, or other secrets that an AI agent has access to, without any human noticing, because the theft is disguised as ordinary conversational filler inside normal tool output.
What you can do
- →Treat all tool/plugin output as untrusted input and strip or flag suspicious trailing text that resembles injected instructions.
- →Restrict what secrets or credentials an agent can access or output in the first place, so a successful injection has less to steal.
- →Log and review cases where an agent's actions change abruptly after a tool call, especially around casual phrases like 'oh and' or 'BTW'.
- →When writing security training or documentation for agent consumption, avoid casual transition phrasing near sensitive terms like private keys, to reduce false positives and ambiguity.
Known benign look-alikes
- A cybersecurity training document that uses phrases like 'BTW, the private key management best practices...' when discussing SSH key rotation procedures in an educational context, which could match regex [1] despite being legitimate security guidance.