# Illegitimate Prescription Fulfillment

- **Severity:** High
- **Signature ID:** `3e07244e-5359-413c-a806-7c8893f9baf7`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI08 (Supply Chain Attacks on Agent Ecosystems), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

An attacker instructs an AI agent that has email and prescription-related capabilities to find paid requests for illegitimate prescriptions and then confirm or issue them automatically. This turns the agent into a tool for prescription fraud instead of a safe assistant.

## How the attack works

The attacker sends the agent a prompt asking it to search for or identify incoming requests that are paying for prescriptions outside legitimate medical channels. The agent is then directed to confirm these requests and issue the prescription, often by email. This mirrors a known multi-step misuse pattern (from the AgentHarm benchmark) where an agent's task-following behavior is exploited to bypass the human judgment normally required for prescribing controlled or restricted medication.

## Why it matters

An organization running such an agent could have it actually issue or confirm fraudulent prescriptions, creating legal liability, regulatory exposure, and potential harm to patients who receive medication without proper medical oversight.

## What you can do

- Restrict agent permissions so prescription issuance or confirmation always requires human review by a licensed professional.
- Do not allow agents to take instructions about prescription fulfillment directly from end-user prompts without independent verification against legitimate medical records.
- Log and review all agent actions that touch prescription-related email or messaging workflows.
- Add explicit checks that block automated confirmation of payment-linked prescription requests.

## Known benign look-alikes

- Pharmacists flagging an illegitimate prescription for reporting
- Clinics describing detection of illegitimate prescription requests

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01844
- https://github.com/ai-safety-institute/AgentHarm

---
Source: https://www.netzilo.com/threats/atr-illegitimate-prescription-fulfillment