# Indirect PI — MFA Code / OTP Security Code Exfiltration via Injection

- **Severity:** Critical
- **Signature ID:** `f9317ceb-f561-46a4-a0e6-63f9e4b53c04`
- **MITRE ATLAS:** AML.T0051.001 (Indirect), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI03 (Identity and Impersonation), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

This rule flags content that tries to hijack an AI agent's access to a user's email or SMS to steal one-time passcodes (OTP/MFA codes) in real time. The injected text overrides the agent's instructions and tells it to find a verification code and send it to an attacker's address, enabling account takeover before the code expires.

## How the attack works

An attacker plants a message — in an email, a document, or another source the AI agent reads — containing text like "IMPORTANT!!! Ignore all previous instructions." That text instructs the agent to search the user's inbox or messages for an incoming OTP, MFA code, or security code. The agent then forwards or discloses that code to an address or channel the attacker controls. Because MFA codes are short-lived, the attacker needs the agent to act quickly, which is why the injected instruction is written to be followed immediately and without question.

## Why it matters

If the agent complies, the attacker gets a live authentication code and can use it to log into the victim's account, bypassing multi-factor authentication entirely.

## What you can do

- Restrict AI agents that can read email or SMS from also having the ability to forward, send, or reply to messages autonomously.
- Require explicit user confirmation before an agent forwards any code, credential, or security-related content out of an inbox.
- Treat any instruction embedded in email/document content that tries to override the agent's original task (e.g. "ignore previous instructions") as untrusted input, not a command.
- Log and alert on agent actions that involve reading and then immediately transmitting content matching OTP/MFA code patterns.

## Known benign look-alikes

- Security setup documentation explaining how OTP codes are generated
- Legitimate support workflow forwarding authentication code to account holder's verified email
- Security testing documentation describing MFA bypass techniques

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00862
- https://github.com/CUA-Framework/VPIBench
- https://arxiv.org/abs/2408.11972

---
Source: https://www.netzilo.com/threats/atr-indirect-pi-mfa-code-otp-security-code-exfiltration-via-inje