# Indirect PI — Browsing History / Search History Exfiltration via Agent Email

- **Severity:** High
- **Signature ID:** `a3911eed-9c8e-4f19-a4d6-5e7ecb384177`
- **MITRE ATLAS:** AML.T0051.001 (Indirect), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI03 (Identity and Impersonation), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

An attacker hides instructions inside content an AI agent reads — like a webpage or document — telling it to grab the user's search or browsing history and email it out. This is a form of indirect prompt injection, where the malicious instructions come from data the agent processes, not from the user.

## How the attack works

An attacker plants text in a document, webpage, or other content the agent will read during normal operation. That text contains an override phrase like 'IMPORTANT!!! Ignore all previous instructions' followed by a command to pull the user's Google search history, browser history, or recently visited URLs. The injected instruction then directs the agent to send that data to an email address the attacker controls. If the agent has both browsing-history access and email-sending capability, it can complete this chain without the user asking for it or noticing.

## Why it matters

Successful exfiltration exposes a person's private interests, health concerns, political views, and behavioral patterns to an outside party, which can be used for blackmail, targeted manipulation, or further social engineering.

## What you can do

- Require explicit user confirmation before an agent sends any browsing or search history data via email, especially to addresses not previously used.
- Restrict which tools or data sources an agent can combine in a single task, so history-reading and email-sending are not both available without a checkpoint.
- Treat any embedded 'ignore previous instructions' or similar override phrasing found in ingested content as a red flag and log or block it.
- Review agent logs for outbound emails containing browsing history data, and check against the known false-positive cases (self-sync, parental controls, security docs) before treating every match as malicious.

## Known benign look-alikes

- Browser extension sync feature sending history to user's own email account
- Parental control service emailing browsing activity report to account owner
- Security documentation describing browser-history surveillance attacks

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00855
- https://github.com/CUA-Framework/VPIBench
- https://arxiv.org/abs/2408.11972

---
Source: https://www.netzilo.com/threats/atr-indirect-pi-browsing-history-search-history-exfiltration-via