Indirect PI — XSS Payload Injection in Agent-Consumed Content
An attacker plants text inside a webpage, document, or tool output that an AI agent is expected to read and summarize. That hidden text tells the agent to stop summarizing and instead reproduce an XSS payload, like an image tag with a malicious onerror handler, in its response.
How the attack works
An attacker embeds a block of text in content the agent will fetch or process, such as a web page, PDF, or API response. The block uses a fake instruction delimiter, like 'NEW IMPORTANT INSTRUCTIONS', to make the agent treat it as a legitimate command rather than untrusted data. The instruction tells the agent to output an <img onerror=...> or <script> tag verbatim instead of continuing its original task, such as summarizing the page. If the agent's output is later rendered in an HTML context — a chat UI, a report, a dashboard — the injected script executes in that context.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 8a8f9e5d-79f9-46d7-bc2f-d42afeacc4f3
- Severity
- High
Why it matters
If the agent's output reaches an HTML renderer without sanitization, the attacker gets script execution in whatever session or interface displays that output, which can lead to session hijacking, data theft, or further compromise of the viewing application.
What you can do
- →Treat all agent output as untrusted before rendering it in any HTML context, and sanitize or escape it the same way you would user-submitted input.
- →Strip or neutralize instruction-like delimiters (e.g. 'NEW IMPORTANT INSTRUCTIONS') found inside fetched content before passing it to the agent's context.
- →Apply a strict Content Security Policy to any surface that displays agent-generated output, so injected scripts cannot execute even if they slip through.
- →Review agent pipelines that summarize or relay external content and confirm they cannot be redirected into reproducing raw HTML or script tags verbatim.
Known benign look-alikes
- Security course materials demonstrating XSS injection examples with explicit educational framing
- Web-developer documentation showing onerror handler usage in benign context