Hidden System Instructions with Permission Override
An MCP skill (a plugin or tool an AI agent can use) contains hidden text wrapped in XML-style tags like <IMPORTANT> that tries to override the agent's normal behavior or bypass its security restrictions. This is a form of prompt injection aimed at the AI itself, not the end user, so it can hide inside a tool description a person never reads.
How the attack works
An attacker packages a skill, plugin, or tool definition that an AI agent will load or call. Inside that content they embed a block tagged something like <IMPORTANT> containing directive language addressed to the AI model rather than the human user. When the agent processes the skill, it reads this block as part of its context and may treat it as a legitimate instruction, causing it to ignore prior safety rules, change its behavior, or perform actions the operator did not authorize. The hidden nature of the block means a developer reviewing the skill's visible functionality may miss it.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- f71bd0a1-2e54-46c7-95bf-06bbf9f5f661
- Severity
- High
Why it matters
An AI agent can be silently steered into ignoring its guardrails, leaking data, or taking unauthorized actions, using a tool that looked benign on the surface.
What you can do
- →Review the full source of any MCP skill, plugin, or tool definition before installing it, including comments and metadata, not just the advertised function.
- →Search skill and tool content for XML-style tags (e.g. <IMPORTANT>, <SYSTEM>, <INSTRUCTIONS>) that address the model directly rather than describing functionality to a human.
- →Restrict which sources agents can pull skills or tools from, and require review before new ones are added.
- →Log and periodically audit the full content the agent receives from tools/skills, distinguishing legitimate documentation emphasis from directive commands aimed at overriding behavior.
Known benign look-alikes
- Legitimate documentation emphasizing important configuration steps
- Security warnings about what NOT to do (educational context)