Garak Latentinjection - abuse contact email
This rule flags a known family of prompt-injection attempts that smuggle malicious instructions inside text formatted to look like an abuse-contact email. It comes from the 'garak' automated LLM security testing tool, which generates known attack samples to probe how models respond to hidden instructions.
How the attack works
An attacker crafts input that looks like ordinary reference material, such as an abuse-contact email, but embeds a hidden instruction inside it. When an AI agent processes this content as part of its normal input (for example, summarizing or acting on it), the embedded instruction attempts to override the agent's original task. This is called a 'latent injection' because the malicious command is buried inside seemingly benign, unrelated content rather than being an obvious direct command. The rule matches ten known sample variants of this specific 'abuse contact email' pattern.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 19afa8c0-a2ec-4510-9c99-04d59ab82e93
- Severity
- Medium
Why it matters
If successful, the agent could be tricked into ignoring its intended instructions and instead following attacker-supplied commands, potentially leaking data, taking unauthorized actions, or bypassing safety controls.
What you can do
- →Review any session where this pattern is flagged to confirm whether the content was expected and authorized.
- →Treat any externally sourced text passed to an AI agent (emails, contact forms, tickets) as untrusted input, and separate it clearly from system instructions.
- →Apply output and action controls so the agent cannot take high-impact actions based solely on embedded text content.
- →Log and monitor cases where agent behavior changes immediately after ingesting third-party text.
Known benign look-alikes
- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.