# Indirect PI — Data Destruction Instruction via Agent File/Document Tool

- **Severity:** High
- **Signature ID:** `2b8807e7-fdb8-43d1-a497-99509961a623`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.001 (Indirect)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI03 (Identity and Impersonation), LLM01 (Prompt Injection)

## Summary

An AI agent that reads external documents or files can be tricked into deleting data it wasn't supposed to touch. The malicious instruction isn't typed by a user — it's hidden inside a file, webpage, or record the agent processes as part of its normal job.

## How the attack works

An attacker plants text inside a document, file, or data record that the agent will later read as part of a routine task, such as summarizing a report or processing a form. That hidden text contains an instruction telling the agent to delete, purge, or wipe specific files, documents, or directories. When the agent processes the content, it treats the embedded instruction as a legitimate command rather than untrusted input, and carries out the deletion using its own file or document management tools. This is a standalone destruction technique — it doesn't rely on exfiltrating data first or attacking the operating system directly.

## Why it matters

An organization can lose clinical records, project files, or other business data without any human deliberately deleting them, and without an attacker needing direct system access — the agent itself becomes the tool that destroys the data.

## What you can do

- Require explicit human confirmation before an agent executes any delete, purge, or wipe action on files or documents.
- Restrict which file paths, directories, or record types an agent's delete/write tools can touch, using an allowlist rather than open access.
- Log and review all agent-initiated deletions separately from user-initiated ones so unusual patterns stand out.
- Treat any deletion instruction found inside ingested documents or external content as untrusted and never auto-execute it.

## Known benign look-alikes

- Legitimate data governance workflows where users request deletion of their own records
- GDPR right-to-erasure automation that processes verified user deletion requests

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00716

---
Source: https://www.netzilo.com/threats/atr-indirect-pi-data-destruction-instruction-via-agent-file-docu