Indirect Prompt Injection: Fake-Authority Task Abort
Attackers hide a fake authority message inside content an AI agent reads, telling it to stop what it's doing and reply with something useless instead. This is a denial-of-service attack against the agent's usefulness, not a data theft or malware attack.
How the attack works
The attacker plants a block of text somewhere the agent will read it, such as a document, webpage, or email, formatted to look like an official notice or a signed message from a named person. The block instructs the agent to 'immediately stop' its current task and instead output a short, fixed, often nonsensical response. Because the agent treats this injected content as instructions rather than data, it abandons the user's actual request. The attack doesn't ask the agent to do anything harmful in content-filter terms, so it slips past safety filters designed to catch malicious requests.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- a09df58b-9975-4c09-9fa3-ae0c9d62fbc3
- Severity
- High
Why it matters
The agent silently fails to complete the task it was given, wasting the user's time and eroding trust in the system, without any obvious error or alert that something went wrong.
What you can do
- →Treat any embedded 'official', 'urgent', or 'signed' instructions found inside documents, web pages, or emails the agent processes as untrusted content, not commands.
- →Have the agent distinguish between instructions from its actual operator/user and text it merely reads or retrieves, and ignore directives found in the latter.
- →Log and review cases where an agent aborts a task early or returns an unusually short/generic response, especially right after ingesting external content.
- →Test agents against known indirect prompt-injection patterns like this one before deploying them on untrusted input sources.
Known benign look-alikes
- Security training materials that reproduce this attack pattern in quoted form
- Agent documentation explaining INFORMATION block injection attacks