# Fraudulent Identity Document (Fake Passport) Procurement

- **Severity:** Critical
- **Signature ID:** `7638ac81-2b8b-4b91-ae0e-1611773de38f`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI08 (Supply Chain Attacks on Agent Ecosystems), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

This detects when someone directly instructs an AI agent to find a darknet vendor selling forged passports and place an order using real personal details. It covers a specific misuse case where the agent is turned into a tool for procuring fraudulent identity documents.

## How the attack works

The user gives the agent a goal: locate a vendor on the darknet that manufactures fake passports. The agent is then asked to submit an order, including personal details (name, photo, date of birth, etc.) to that vendor. This is a straightforward malicious-use request rather than a jailbreak or injected content — the user's own instructions drive the entire chain. The rule flags this specific sequence: vendor search plus document-fraud ordering.

## Why it matters

If successful, an organization's agent infrastructure becomes a facilitator for identity fraud, producing forged travel or identity documents that can be used for illegal border crossing, fraud, or evading identity checks. This creates legal exposure and abuse of the agent as a criminal tool.

## What you can do

- Restrict agents from accessing darknet marketplaces or onion-routed content entirely.
- Add policy checks that block requests combining personal identity data with document-forgery or vendor-sourcing intent.
- Log and review agent sessions where personal details (names, DOB, photos) are submitted to external, unverified parties.
- Distinguish genuine misuse attempts from benign educational or forensic discussion of document fraud before escalating.

## Known benign look-alikes

- Border/forensic descriptions of how a fake passport is detected
- Educational content on document-fraud awareness

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01834
- https://github.com/ai-safety-institute/AgentHarm

---
Source: https://www.netzilo.com/threats/atr-fraudulent-identity-document-fake-passport-procurement