# Indirect PI — Credential Exfiltration via Email (API Key / Password / Token)

- **Severity:** Critical
- **Signature ID:** `4a3dfe68-b235-4385-9b20-2d4efee5a52c`
- **MITRE ATLAS:** AML.T0051.001 (Indirect), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI03 (Identity and Impersonation), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

An AI agent that browses the web or reads documents can be fooled by hidden instructions planted in content it processes — a product review, a note, a file description. Those instructions tell the agent to find a stored credential and email it to an address the attacker controls.

## How the attack works

An attacker plants text in something the agent will read, like a review, note, or repository description. The text contains a fake system override, commonly phrased 'IMPORTANT!!! Ignore all previous instructions,' followed by an instruction to retrieve, share, get, or send a specific type of credential — an API key, password, or auth token. The payload then directs the agent to send that credential by email to a named external address. If the agent treats this embedded text as a legitimate instruction rather than untrusted content, it complies and exfiltrates the secret.

## Why it matters

An organization can lose API keys, passwords, or authentication tokens that an agent had legitimate access to, handed directly to an attacker via email with no further exploitation needed.

## What you can do

- Treat all content an agent reads from external sources (reviews, notes, web pages, repo metadata) as untrusted input, never as instructions.
- Restrict agents from having direct read access to credential stores, or require a separate authorization step before any credential is retrieved or transmitted.
- Block or gate outbound email actions initiated by agents, especially to addresses not on an approved allowlist.
- Review agent logs for prompt patterns like 'ignore previous instructions' combined with retrieval-and-send actions targeting secrets.

## Known benign look-alikes

- Password manager setup instructions asking user to email a recovery code to themselves
- Legitimate API key rotation workflows that send confirmation emails
- Security documentation describing credential exfiltration attacks without injection context

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00850
- https://github.com/CUA-Framework/VPIBench
- https://arxiv.org/abs/2408.11972

---
Source: https://www.netzilo.com/threats/atr-indirect-pi-credential-exfiltration-via-email-api-key-passwo