Indirect PI — Financial Data Exfiltration via Agent Action
An AI agent that reads external content, like a document, email, or web page, can be manipulated by hidden text inside that content. The hidden text tells the agent to pull up payment methods, bank details, or financial reports and send them somewhere the attacker controls.
How the attack works
An attacker plants instructions inside content that an AI agent will later read, such as a document, email, spreadsheet, or web page. When the agent processes this content, it treats the embedded text as a command rather than as data. The injected instruction directs the agent to retrieve financial information it has access to, such as bank account numbers, card details, or financial reports. The agent then sends that data to a destination the attacker controls, such as an external URL, email address, or API endpoint, without the user having asked for this.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 5f47b866-f766-42fe-ad69-7a429e144cab
- Severity
- Critical
Why it matters
An organization can lose sensitive financial data — payment methods, bank account details, or financial reports — without any direct attacker access to internal systems, simply by placing malicious instructions where an agent will read them.
What you can do
- →Treat all content an agent reads as untrusted input, not as instructions, and separate data from commands wherever the agent architecture allows it.
- →Restrict agent access to financial data to only what is strictly needed for its task, and require explicit user confirmation before financial information is sent to any external destination.
- →Monitor and log agent actions that involve outbound data transfers, especially to new or unfamiliar destinations, so unusual exfiltration attempts can be caught.
- →Review documents, emails, and other content sources that feed into agents for hidden or unusual instructions before they are ingested at scale.
Known benign look-alikes
- Legitimate banking app integration that retrieves user's own payment methods
- Financial advisor tools that fetch and summarize account data for the authenticated user