Indirect PI — Unauthorized Physical Access Grant via Smart Lock / Home Automation
An AI agent that manages smart locks or home automation can be manipulated by hidden text embedded in content it processes, causing it to grant physical access to unauthorized people. This is an indirect prompt injection: the attacker never talks to the agent directly, they plant instructions in something the agent reads.
How the attack works
An attacker embeds hidden instructions inside content the agent is likely to consume, such as a webpage, email, calendar invite, or document. When the agent processes that content as part of its normal task, it reads the embedded instructions as if they were legitimate commands. The instructions tell the agent to add a new guest to a smart lock system like August or Kwikset, unlock a door, or change access control rules. Because the agent has real tool access to physical security systems, it can carry out the request without ever interacting with the actual attacker.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 1ac3af4e-60de-4def-a018-c2df0ae26f45
- Severity
- Critical
Why it matters
An organization or household loses control over who can physically enter a premises, with the AI agent acting as an unwitting insider that grants building or home access to an unauthorized person.
What you can do
- →Require explicit human confirmation before any agent action that adds a user or unlocks a door in a physical access control system.
- →Restrict which agents have tool access to smart lock or home automation APIs, and separate that access from agents that read untrusted external content.
- →Log and review all access grants and unlock events made through automation systems, flagging any not tied to a verified human request.
- →Treat content consumed by agents (web pages, emails, documents) as untrusted input and sanitize or isolate it before it can trigger privileged actions.
Known benign look-alikes
- Legitimate user granting access to family members via home automation apps with explicit authorization
- Property management systems where the owner instructs access grants for verified tenants