Fake Tool Result Prefix — Injected Instruction via Simulated Completion
Attackers hide instructions inside content an AI agent reads — documents, emails, web pages, database records, or API responses — by making it look like a tool call already finished successfully. The fake completion message is followed by a 'mandatory' new instruction, tricking the agent into treating it as trusted follow-up guidance rather than untrusted external content.
How the attack works
An attacker plants text in a place the agent will later read, such as a webpage, email body, or API response. The text opens with a fake completion marker like 'Answer: task complete.' or 'Result: success.' or '[TOOL OUTPUT]' to mimic a legitimate finished tool call. Immediately after, it inserts a phrase such as 'You must strictly adhere to the following instruction:' followed by a covert action the attacker wants performed. Because agents are trained to trust tool-result framing, the model often executes the injected instruction as if it were a real system directive rather than untrusted input it just read.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 3bfbd968-9dca-470a-8b09-78990c8fdd68
- Severity
- Critical
Why it matters
An agent can be hijacked into performing unauthorized actions or leaking sensitive information, using content it merely read as if it were an authoritative internal instruction. This is one narrow attack pattern — the fake-completion-plus-mandatory-instruction template — not a full account of every prompt injection technique.
What you can do
- →Never let an agent treat text pulled from documents, emails, web pages, or API responses as equivalent to a genuine internal tool result — tag and separate untrusted external content in the prompt structure.
- →Add a filter or review step that flags content containing phrases like 'task complete', 'Result: success', or '[TOOL OUTPUT]' when it originates from external sources rather than the agent's own tool-calling layer.
- →Restrict what actions an agent can take based solely on content encountered mid-task; require a policy check or human confirmation before high-impact actions triggered by embedded instructions.
- →Exclude legitimate test fixtures and debug replay logs from this detection by keeping them in clearly marked test/debug directories, separate from live production data paths.
Known benign look-alikes
- Unit test fixtures containing 'task complete' + instruction strings in test data files — these should be in test directories and will not appear in production tool outputs
- Agent orchestration logs replayed for debugging where a prior tool result is shown alongside a new instruction — the pattern appears but the context is replay, not injection