# Indirect PI — Account Manipulation / Emergency Service Dispatch via Pretext

- **Severity:** Critical
- **Signature ID:** `f0965d09-4d85-4aab-b77c-84bfc6dba792`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.001 (Indirect)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI03 (Identity and Impersonation), LLM01 (Prompt Injection)

## Summary

Attackers hide instructions inside data an AI agent reads — like a document, webpage, or API response — that fabricate an emergency (a fire, a break-in, a threat) to pressure the agent into taking urgent action. If the agent has tools for emergency dispatch or account management, it may act on the fake pretext without verifying it's real.

## How the attack works

An attacker plants a prompt injection payload inside structured data that an AI agent is expected to consume, such as a document field, ticket, or API response. The payload poses as an urgent emergency — claiming a fire, intrusion, or safety threat at a specific address — to manipulate the agent's behavior. Because the agent trusts content it processes as part of its normal workflow, it does not distinguish a real emergency report from injected text. If the agent has access to emergency dispatch tools or account security settings, it may act on the fabricated pretext: sending a dispatch request to an address, or weakening security policies under the guise of urgent need.

## Why it matters

An organization could see false emergency dispatches sent to real addresses, wasting first-responder resources, or find account security settings quietly weakened by an agent tricked into treating a fake crisis as legitimate.

## What you can do

- Require independent verification (not from agent-consumed data) before any dispatch or security-policy action tied to an emergency claim.
- Restrict which agents can call emergency dispatch or account-security tools, and require human approval for these actions.
- Treat any embedded instructions found in ingested documents, tickets, or API data as untrusted content, never as commands.
- Log and review all emergency-triggered dispatch or security-policy changes for a verified source and authorization trail.

## Known benign look-alikes

- Legitimate emergency dispatch systems with verified first-responder access
- Security administrators updating their own security policies with verified domains

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00722

---
Source: https://www.netzilo.com/threats/atr-indirect-pi-account-manipulation-emergency-service-dispatch