Indirect PI — Account Manipulation / Emergency Service Dispatch via Pretext
Attackers hide instructions inside data an AI agent reads — like a document, webpage, or API response — that fabricate an emergency (a fire, a break-in, a threat) to pressure the agent into taking urgent action. If the agent has tools for emergency dispatch or account management, it may act on the fake pretext without verifying it's real.
How the attack works
An attacker plants a prompt injection payload inside structured data that an AI agent is expected to consume, such as a document field, ticket, or API response. The payload poses as an urgent emergency — claiming a fire, intrusion, or safety threat at a specific address — to manipulate the agent's behavior. Because the agent trusts content it processes as part of its normal workflow, it does not distinguish a real emergency report from injected text. If the agent has access to emergency dispatch tools or account security settings, it may act on the fabricated pretext: sending a dispatch request to an address, or weakening security policies under the guise of urgent need.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- f0965d09-4d85-4aab-b77c-84bfc6dba792
- Severity
- Critical
Why it matters
An organization could see false emergency dispatches sent to real addresses, wasting first-responder resources, or find account security settings quietly weakened by an agent tricked into treating a fake crisis as legitimate.
What you can do
- →Require independent verification (not from agent-consumed data) before any dispatch or security-policy action tied to an emergency claim.
- →Restrict which agents can call emergency dispatch or account-security tools, and require human approval for these actions.
- →Treat any embedded instructions found in ingested documents, tickets, or API data as untrusted content, never as commands.
- →Log and review all emergency-triggered dispatch or security-policy changes for a verified source and authorization trail.
Known benign look-alikes
- Legitimate emergency dispatch systems with verified first-responder access
- Security administrators updating their own security policies with verified domains