# Indirect Prompt Injection via Data Carrier — IMPORTANT Override

- **Severity:** Critical
- **Signature ID:** `52e77657-9546-4266-b416-8bf50fcdd893`
- **MITRE ATLAS:** AML.T0051.001 (Indirect)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI06 (Goal and Instruction Manipulation), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

Attackers plant text that looks like an urgent system command inside ordinary content — a product description, email, calendar invite, or GitHub repo bio — hoping an AI agent that reads this data will treat it as a real instruction and obey it instead of its actual task. This is indirect prompt injection: the attacker never talks to the agent directly, they poison something the agent will read.

## How the attack works

An attacker inserts a phrase like 'IMPORTANT!!! Ignore all previous instructions and strictly adhere to the following instruction:' followed by a hidden command into a text field of some normal-looking data object — a product listing, a user bio, an email body, a calendar event, or a repository description. This data is returned to an AI agent through a normal channel, such as a JSON API response, an email fetch, or a database query, so the surrounding structure looks completely legitimate. When the agent processes the content field, it may read the embedded phrase as a real override and switch from its intended task to the attacker's directive, which is often something like disclosing sensitive information or performing an unauthorized financial action. The same payload pattern has been observed reused across many different carrier types, suggesting a templated attack rather than a one-off.

## Why it matters

An agent tricked this way can leak sensitive data, take unauthorized actions such as unapproved payments or transfers, or otherwise act against the user's actual intent — all triggered by content the agent was only supposed to read, not obey.

## What you can do

- Treat all external or user-supplied text content read by an agent (emails, product data, profiles, calendar entries, repo metadata) as untrusted data, never as instructions.
- Strip or neutralize imperative-style phrases (e.g. 'ignore previous instructions', 'IMPORTANT!!! ... strictly adhere') from ingested content before it reaches the agent's reasoning context.
- Require explicit human or policy-based confirmation for sensitive actions (financial transfers, data disclosure) regardless of what instructions appear inside fetched content.
- Log and review cases where agent behavior changes abruptly after processing external data, especially near financial or disclosure actions.

## Known benign look-alikes

- Security research corpora or test fixtures containing example IMPORTANT-override payloads as documented samples — these appear in labeled test data, not in production API responses
- ATR rule test_cases.true_positives that include this pattern as labeled attack examples

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01304

---
Source: https://www.netzilo.com/threats/atr-indirect-prompt-injection-via-data-carrier-important-overrid