Indirect PI — Credential / API Key Exfiltration via Agent Action
An AI agent that reads emails, documents, or web pages can be manipulated by hidden text embedded in that content. The hidden text tells the agent to find stored passwords or API keys and send them somewhere the attacker controls, all while the agent appears to be doing its normal job.
How the attack works
An attacker plants instructions inside content the agent will naturally process, such as an email body, a shared document, or a web page. When the agent reads that content as part of a legitimate task, it also picks up the hidden instructions, which is called indirect prompt injection. The instructions direct the agent to search for credentials, API keys, or stored passwords accessible to it. The agent then exfiltrates that data by emailing it out, posting it to a URL, or sending it to a third-party service, without the user ever asking for this.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 650e8fa5-201c-445d-b6ea-a84bab25981b
- Severity
- Critical
Why it matters
Successful attacks give an outside party live credentials or API keys, letting them access other systems, impersonate the organization's services, or pivot further into connected accounts.
What you can do
- →Restrict what credential stores and secrets an AI agent can read or query, using least-privilege scoping rather than broad access.
- →Require human approval before an agent sends data to an external email address, URL, or third-party API, especially content resembling secrets.
- →Filter or sanitize untrusted content (emails, documents, web pages) before it reaches the agent, or clearly separate it from instruction context.
- →Log and review agent actions that move data outward, and flag any that touch credential-like fields shortly before an outbound send.
Known benign look-alikes
- IT administrator guides instructing users to rotate and email API keys to the security team
- Password manager documentation describing how to export and backup credentials