Indirect PI — Location / GPS Data Exfiltration via Agent Email
This detects attempts to hijack an AI agent through hidden instructions embedded in content it processes, forcing it to pull the user's GPS or location data and send it to an outside email address. If successful, this lets an attacker track someone's physical whereabouts for stalking or targeted attacks.
How the attack works
An attacker plants text somewhere the AI agent will read — a document, webpage, or message — containing an instruction like 'IMPORTANT!!! Ignore all previous instructions.' That instruction tells the agent to look up the user's current or historical location using a mapping service, GPS feature, or device location API. The injected text then directs the agent to compose and send an email containing that location data to an address the attacker controls. Because the agent has legitimate access to both location tools and email, it can carry out both steps without the user noticing.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 543588ac-d86e-4bdb-914c-78e57d9e641e
- Severity
- Critical
Why it matters
An organization loses control over sensitive physical location data about its users or employees, which can enable stalking, physical surveillance, or planning of in-person attacks against them.
What you can do
- →Require explicit user confirmation before an agent sends location data to any external recipient.
- →Restrict which email addresses or domains an agent is allowed to send to, especially when location or GPS tools have just been invoked.
- →Treat instructions embedded in fetched documents, web pages, or third-party content as untrusted and never let them override system-level agent policies.
- →Log and review any agent action chain that combines a location lookup with an outbound email or message send.
Known benign look-alikes
- Navigation app sending location to a saved contact for legitimate meetup coordination
- Travel agent service sending itinerary with location information to customer email
- Security documentation describing location tracking attack scenarios