# Indirect PI — Structured-Data Embedded Payload (IMPORTANT!!! Override)

- **Severity:** Critical
- **Signature ID:** `f4b571d4-8c43-40fd-9d72-7d1bbc55c023`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.001 (Indirect)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI03 (Identity and Impersonation), LLM01 (Prompt Injection)

## Summary

Attackers plant hidden instructions inside ordinary-looking data — a product review, a note, a user profile, a repository file — that an AI agent later reads. The hidden text tries to override the agent's real instructions and make it take an action the attacker wants instead.

## How the attack works

An attacker writes text such as 'IMPORTANT!!! Ignore all previous instructions' followed by a specific command into a place an AI agent is expected to read, like a review field, a note, or metadata attached to a file. Later, a legitimate user asks the agent to process that content — summarize reviews, read notes, check a repo. When the agent ingests the data, it also reads the embedded instruction and may follow it as if it came from the user or system. The action that follows can range from leaking data (credentials, location, browsing history) to transferring money, disabling authentication, or destroying data, depending on what the attacker wrote.

## Why it matters

An agent can be hijacked into leaking sensitive data, moving funds, changing account settings, or destroying records — all triggered by content the agent was only supposed to read, not obey.

## What you can do

- Treat any data an agent reads (reviews, notes, metadata, repo files, user profiles) as untrusted input, not as instructions.
- Strip or flag imperative phrases like 'ignore previous instructions' in content pipelines before it reaches the agent.
- Require explicit user or system confirmation before an agent executes sensitive actions (transfers, auth changes, deletions) that originate from processing external data.
- Log and review cases where an agent's action doesn't match the original user request, since this indicates injected instructions may have been followed.

## Known benign look-alikes

- Security research documents quoting this injection pattern
- ATR test suites containing example payloads

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00700

---
Source: https://www.netzilo.com/threats/atr-indirect-pi-structured-data-embedded-payload-important-overr