Indirect PI — Disable Authentication / MFA via Agent Tool

How the attack works

An attacker plants instructions inside content the agent is expected to process, such as a document, support ticket, or webpage, rather than sending the instructions directly to the agent's chat interface. When the agent ingests this content as part of its normal task, it treats the embedded text as a command rather than as data. If the agent has tool access to account or security settings, it follows the injected instruction to disable 2FA, MFA, or other protections. This happens without any direct interaction from the attacker with the agent itself.

Netzilo detection

Why it matters

Successful exploitation removes a security barrier protecting user or system accounts, making the account or wider environment easier to take over, often without the account owner's knowledge.

What you can do

• →Restrict which agents can call account-security or authentication-management tools, and require human approval for any action that weakens security controls.
• →Treat all content an agent ingests from external or untrusted sources (documents, emails, tickets, web pages) as data, not instructions, and sanitize or isolate it before the agent processes it.
• →Log and alert on any agent-initiated change to authentication or MFA settings, especially when triggered during a document- or content-processing task rather than a direct user request.
• →Review known false-positive cases (legitimate admin guides or user-requested MFA changes) to tune detections and avoid alert fatigue.

Known benign look-alikes

• Security configuration guides instructing administrators to disable MFA for testing in isolated environments
• User guides explaining how to manage 2FA settings when directly requested by the account owner

References

• https://agentthreatrule.org/en/rules/ATR-2026-00709

Related threats