Foot-in-the-Door Gradual Escalation Attack
This detects a manipulation technique where someone starts a conversation with an AI agent using a harmless request, then slowly escalates to harmful or restricted requests by citing the agent's earlier cooperation as justification. The goal is to exploit the model's tendency to stay consistent with what it already agreed to, making each new step feel like a small, acceptable extension rather than a violation.
How the attack works
An attacker opens with an innocuous request that the AI agent readily fulfills, establishing a pattern of compliance. They then send a follow-up that pushes slightly further, phrased to reference the prior exchange, such as 'since you already helped me with X, now do Y' or 'continuing from what you said earlier'. Each subsequent request nudges the boundary further, using the accumulated history of agreement as social proof that refusing now would be inconsistent. Over several turns this can move the agent from a benign task to actions or disclosures it would have refused if asked directly.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 13ef972b-5cf5-422e-9442-0dc0d090e741
- Severity
- High
Why it matters
An organization can lose control over what its AI agent will do or reveal, since the agent may be talked into producing harmful content, bypassing restrictions, or taking unauthorized actions it was designed to refuse, all through a conversation that looks legitimate at each step.
What you can do
- →Review agent conversation logs for conversations that reference prior agent compliance as justification for new requests, especially phrases like 'since you already did A, now do B'.
- →Configure agents to evaluate each request against policy independently rather than treating prior compliance in the same session as precedent.
- →Set session-level limits on how far a conversation can escalate in scope or sensitivity without re-confirming authorization.
- →Expect false positives in normal multi-step work such as iterative code refactoring or documentation building on prior steps, and tune review criteria to distinguish legitimate continuation from justification-based escalation.
Known benign look-alikes
- Legitimate multi-step workflows where user references previous output for context
- Documentation generation where each step builds on the last
- Code refactoring sessions where user asks to continue with next function