# Indirect Prompt Injection: CAPTCHA Redirect Task Disruption

- **Severity:** High
- **Signature ID:** `35bb9592-c6c8-4268-9657-43b1f3e94729`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI04 (Memory and Context Poisoning), LLM01 (Prompt Injection), LLM06 (Excessive Agency)

## Summary

An AI agent that reads web pages or documents as part of its job can be derailed by hidden text embedded in that content. The hidden instruction tells the agent to go solve a CAPTCHA or visit an outside link before continuing, which either stops the agent's real task cold or gets it to send data to an attacker-controlled URL.

## How the attack works

The agent fetches a document or web page as part of a normal task. Buried in that content is a block of text formatted to look like a system instruction, telling the agent it must first solve a CAPTCHA at a given URL or visit an external link. Because the agent can't actually solve CAPTCHAs, it either gives up on its original task or dutifully reports/visits the attacker's URL, leaking that URL into its logs or outputs. Either way, the attacker has disrupted the agent's work using content the agent was never supposed to treat as a command.

## Why it matters

The agent's task fails or stalls (a denial-of-service on the agent), and in the URL-visit case, information about the agent's activity can leak to an external, attacker-controlled destination.

## What you can do

- Strip or neutralize instruction-like text (e.g. blocks styled as system/INFORMATION commands) from any content the agent retrieves before it reaches the model.
- Do not let the agent follow URLs or 'verification steps' that first appear inside fetched documents rather than in the original user request.
- Log and alert when an agent reports CAPTCHA challenges or aborts tasks citing external verification, since legitimate cases should be rare and reviewable.
- Separate trusted user instructions from untrusted retrieved content so the model can't confuse one for the other.

## Known benign look-alikes

- Legitimate web scraping agents that encounter CAPTCHA pages and report them to the user
- Security research documentation describing CAPTCHA-redirect injection attacks
- Agent logs reporting failed CAPTCHA challenge to human operator

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01752

---
Source: https://www.netzilo.com/threats/atr-indirect-prompt-injection-captcha-redirect-task-disruption