Indirect PI — Location, Address, and Browsing History Exfiltration

How the attack works

An attacker plants malicious instructions inside content the AI agent is likely to process, such as a document, webpage, or email. When the agent reads this content as part of its normal task, it also reads the hidden instruction, which is written to look like a legitimate command. The instruction directs the agent to pull sensitive data it has access to — current location from a maps tool, saved addresses from an address book, or search history from a browser — and send it somewhere the attacker controls. This all happens as a side effect of the agent doing its regular job, so the user sees nothing unusual.

Netzilo detection

Why it matters

An organization can have employee or customer location, home/work addresses, and browsing history quietly exfiltrated through an AI agent that was never directly compromised — just fed poisoned content it was trusted to process.

What you can do

• →Restrict which tools (maps, address books, browser history) an AI agent can access by default, and require explicit user approval before it shares location or personal data externally.
• →Treat any content the agent ingests from outside sources (web pages, emails, shared documents) as untrusted input, not as instructions to follow.
• →Log and review agent actions that read location, address, or browsing-history tools, especially when paired with an outbound send or share action.
• →Separate agents that process external content from agents with access to sensitive personal data stores, so one compromised input can't reach both.

Known benign look-alikes

• Navigation apps that share current location with emergency contacts
• Browser backup tools legitimately syncing history to user's own account

References

• https://agentthreatrule.org/en/rules/ATR-2026-00705

Related threats