Indirect Authority Claim in External Content
Attackers plant text inside documents, web pages, or tool outputs that speaks directly to an AI agent, pretending to be an authoritative correction. Instead of commanding the AI outright, it politely claims something like 'the previous analysis was incorrect' to get the agent to change its behavior or output.
How the attack works
An attacker embeds a phrase such as 'Note to AI', 'Attention AI', or 'Important for the assistant' inside content the AI agent will later read - a document, a search result, a tool response, or a web page. The phrase is paired with a soft corrective instruction, like 'please recalculate' or 'the previous analysis was incorrect'. Because this avoids blunt override language such as 'ignore previous instructions', it slips past filters built to catch explicit injection attempts. The agent, treating the embedded note as a legitimate correction from an authority, revises its reasoning or output accordingly.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- a186c61c-35b3-4467-b502-6809aad9a4ae
- Severity
- High
Why it matters
An attacker can quietly steer an agent's conclusions, calculations, or actions by planting content the agent will ingest, without needing direct access to the agent's prompt or configuration.
What you can do
- →Treat any text addressed to 'the AI' or 'the assistant' inside ingested documents or tool outputs as suspicious, regardless of tone.
- →Keep external content and agent instructions in clearly separated channels so ingested text cannot be mistaken for system guidance.
- →Require the agent to flag and surface any embedded correction claims to a human reviewer before acting on them.
- →Expect false positives from legitimate scholarly or peer-review text that critiques prior analysis; review flagged content for direct address to the AI before treating it as an attack.
Known benign look-alikes
- A peer review document or academic paper that critiques a prior computational analysis, e.g. 'The original evaluation was flawed due to selection bias in the sample', triggering Layer 5 despite being legitimate scholarly discourse.