Indirect PI — Physical / Biometric Media Exfiltration via Agent
Attackers hide commands inside content an AI agent reads — like a document or webpage — telling it to grab voice recordings or ID scans and generate deepfake audio or send the data out. The agent follows these hidden instructions instead of just doing what its actual user asked.
How the attack works
An attacker plants malicious instructions inside content the agent will process, such as a document, email, or web page (indirect prompt injection). When the agent reads this content as part of its normal task, it also picks up the hidden instructions. Those instructions direct the agent to locate biometric material — recorded voice samples, passport scans, or ID photos — convert or process that material (for example, generating deepfake audio from a voice sample), and then send the result to a destination the attacker controls. Because the agent has legitimate access to files and network actions, it can carry this out without the real user noticing.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- fe8c639f-435f-4b1b-a07a-1292c75dbf4d
- Severity
- Critical
Why it matters
An organization can lose control of sensitive biometric identity data — voices and ID documents — which can then be used for deepfake fraud, identity theft, or impersonation attacks against employees or customers.
What you can do
- →Restrict agent access to voice recordings, ID scans, and other biometric files unless explicitly required for the task at hand.
- →Treat any content an agent ingests from untrusted sources (documents, emails, web pages) as potentially containing instructions, and sandbox or filter it before the agent acts on it.
- →Require explicit human approval before an agent exports files, generates audio from voice samples, or sends data to external destinations.
- →Monitor and log agent actions that touch biometric or identity files, especially when followed by outbound network requests.
Known benign look-alikes
- Legitimate voice cloning tools where the user directly requests audio generation for personal use
- Audio processing pipelines that convert and store media without external exfiltration