Delayed Tool Invocation via Prompt Injection (Time-Shifted Execution)
An attacker hides instructions in content an AI agent reads — an email, document, or webpage — that tell it to do something harmful not right away, but the next time it performs some other action. This lets the malicious instruction slip past security checks that only look at what the agent is doing in the moment.
How the attack works
The attacker injects text into content the agent will process, such as a document, email body, or web page. The text does not ask for immediate action; instead it uses phrasing like 'next time', 'when you next respond', or 'schedule for next run' to plant a dormant instruction. The agent stores this instruction in its context or memory. On a later turn — the next email send, the next browsing action, or the next reply — the agent carries out the deferred instruction, which typically involves accessing credentials, exfiltrating context, forwarding data, or visiting an attacker-controlled URL. Because the harmful action happens separately from the injection itself, controls that only inspect the current step miss the connection.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 02ddfc8c-f0fc-444e-818e-94828ce1148a
- Severity
- Critical
Why it matters
An organization can have an agent silently primed to leak credentials, forward sensitive data, or reach out to attacker infrastructure at a later, unpredictable point, evading review that focuses only on the immediate request.
What you can do
- →Treat any instruction found in ingested content (emails, documents, web pages) that references future actions or 'next time' behavior as suspicious, not just instructions requesting immediate action.
- →Review and clear agent memory or context state between sessions or tasks so planted instructions cannot persist across turns.
- →Require re-validation of high-risk actions (credential access, sending email, forwarding data, visiting external URLs) at the moment they execute, regardless of when the triggering instruction was received.
- →Log and audit agent actions that reference or fulfill instructions from earlier turns, so deferred-execution patterns can be traced back to their origin.
Known benign look-alikes
- Legitimate multi-step workflow instructions: 'execute the tests after the build completes'
- Legitimate scheduling requests: 'remind me tomorrow', 'schedule a follow-up for next week'
- CI/CD pipeline instructions referencing sequential steps
- User confirmation gates: 'when user confirms, proceed with file transfer'