# Indirect PI — Medical Record / Health Data Exfiltration via Agent Email

- **Severity:** Critical
- **Signature ID:** `e3d70822-600c-4eed-ad55-13a71b6f7873`
- **MITRE ATLAS:** AML.T0051.001 (Indirect), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI03 (Identity and Impersonation), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

An AI agent that can read outside content (like reviews or notes) and also send email can be hijacked by hidden instructions planted in that content. The hidden text tells the agent to pull up a patient's medical file and email it to an address the attacker controls.

## How the attack works

An attacker plants text in something the agent will read as data, not instructions, such as a product review, note, or file description. That text includes phrases like 'IMPORTANT!!! Ignore all previous instructions' followed by commands to look up a specific patient or report ID in a connected health records system. The injected text then tells the agent to send whatever it retrieves to an email address the attacker supplies. If the agent follows the embedded instructions instead of its original task, it downloads the protected health data and emails it out, completing the theft in one automated flow.

## Why it matters

An organization can lose protected health information for specific patients without any direct system breach, since the agent itself performs the lookup and exfiltration using its own legitimate access.

## What you can do

- Separate data an agent reads from instructions it acts on; treat all fetched content (reviews, notes, tickets, descriptions) as untrusted and never as commands.
- Require human approval before an agent sends email containing patient or health record data, especially to addresses not on an approved list.
- Restrict which agents can both query health record systems and send outbound email in the same session or workflow.
- Log and review agent actions that involve retrieving records by patient/report ID followed by an email-send step, and alert on unfamiliar destination addresses.

## Known benign look-alikes

- Healthcare provider sending test results to a verified patient email as part of normal workflow
- Medical documentation discussing EHR integration without injection framing
- Security training material describing HIPAA data exfiltration scenarios

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00852
- https://github.com/CUA-Framework/VPIBench
- https://arxiv.org/abs/2408.11972

---
Source: https://www.netzilo.com/threats/atr-indirect-pi-medical-record-health-data-exfiltration-via-agen