# Indirect PI — Location, Address, and Browsing History Exfiltration

- **Severity:** High
- **Signature ID:** `7cbaf337-afda-4593-918a-3ed745713385`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.001 (Indirect)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI07 (Unsafe Autonomous Code Execution), LLM01 (Prompt Injection), LLM06 (Excessive Agency)

## Summary

Attackers hide commands inside content that an AI agent reads — like a webpage, document, or email — telling it to secretly send out the user's current location, saved home/work addresses, or Google search history. If the agent has access to maps, contact, or browser tools, it may follow these hidden instructions without the user knowing.

## How the attack works

An attacker plants malicious instructions inside content the AI agent is likely to process, such as a document, webpage, or email. When the agent reads this content as part of its normal task, it also reads the hidden instruction, which is written to look like a legitimate command. The instruction directs the agent to pull sensitive data it has access to — current location from a maps tool, saved addresses from an address book, or search history from a browser — and send it somewhere the attacker controls. This all happens as a side effect of the agent doing its regular job, so the user sees nothing unusual.

## Why it matters

An organization can have employee or customer location, home/work addresses, and browsing history quietly exfiltrated through an AI agent that was never directly compromised — just fed poisoned content it was trusted to process.

## What you can do

- Restrict which tools (maps, address books, browser history) an AI agent can access by default, and require explicit user approval before it shares location or personal data externally.
- Treat any content the agent ingests from outside sources (web pages, emails, shared documents) as untrusted input, not as instructions to follow.
- Log and review agent actions that read location, address, or browsing-history tools, especially when paired with an outbound send or share action.
- Separate agents that process external content from agents with access to sensitive personal data stores, so one compromised input can't reach both.

## Known benign look-alikes

- Navigation apps that share current location with emergency contacts
- Browser backup tools legitimately syncing history to user's own account

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00705

---
Source: https://www.netzilo.com/threats/atr-indirect-pi-location-address-and-browsing-history-exfiltrati