Indirect PI — Physical Address / PII Exfiltration via Agent Email

How the attack works

An attacker plants a message inside content the agent will read — a webpage, document, or email — containing text like 'IMPORTANT!!! Ignore all previous instructions.' The injected instructions tell the agent to look up the user's saved account addresses and send them to an email address the attacker controls. Because the agent trusts content it processes as part of its task, it can follow these embedded commands instead of the original user request. The result is the user's physical address quietly exfiltrated without their knowledge.

Netzilo detection

Why it matters

Combined with a name, a leaked physical address enables stalking, burglary, and identity theft. The victim has no visibility that their address was sent anywhere since the request came from a manipulated agent rather than a phishing email they might notice.

What you can do

• →Restrict AI agents from autonomously sending emails containing stored personal data without explicit user confirmation.
• →Require a human-in-the-loop step before any agent action combines address lookups with an external send action.
• →Audit what data sources and content an agent is allowed to read before it acts, especially untrusted third-party text.
• →Review agent logs for address-lookup actions followed by email or export actions to unfamiliar recipients.

Known benign look-alikes

• User requesting their own address book export for personal backup
• Address update confirmation email sent to account holder
• Security documentation describing address exfiltration attack scenarios

References

• https://agentthreatrule.org/en/rules/ATR-2026-00856
• https://github.com/CUA-Framework/VPIBench
• https://arxiv.org/abs/2408.11972

Related threats