Indirect PI — MFA Code / OTP Security Code Exfiltration via Injection
This rule flags content that tries to hijack an AI agent's access to a user's email or SMS to steal one-time passcodes (OTP/MFA codes) in real time. The injected text overrides the agent's instructions and tells it to find a verification code and send it to an attacker's address, enabling account takeover before the code expires.
How the attack works
An attacker plants a message — in an email, a document, or another source the AI agent reads — containing text like "IMPORTANT!!! Ignore all previous instructions." That text instructs the agent to search the user's inbox or messages for an incoming OTP, MFA code, or security code. The agent then forwards or discloses that code to an address or channel the attacker controls. Because MFA codes are short-lived, the attacker needs the agent to act quickly, which is why the injected instruction is written to be followed immediately and without question.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- f9317ceb-f561-46a4-a0e6-63f9e4b53c04
- Severity
- Critical
Why it matters
If the agent complies, the attacker gets a live authentication code and can use it to log into the victim's account, bypassing multi-factor authentication entirely.
What you can do
- →Restrict AI agents that can read email or SMS from also having the ability to forward, send, or reply to messages autonomously.
- →Require explicit user confirmation before an agent forwards any code, credential, or security-related content out of an inbox.
- →Treat any instruction embedded in email/document content that tries to override the agent's original task (e.g. "ignore previous instructions") as untrusted input, not a command.
- →Log and alert on agent actions that involve reading and then immediately transmitting content matching OTP/MFA code patterns.
Known benign look-alikes
- Security setup documentation explaining how OTP codes are generated
- Legitimate support workflow forwarding authentication code to account holder's verified email
- Security testing documentation describing MFA bypass techniques