Indirect Prompt Injection via Tool / API Response — Attacker Instruction Embedded in Returned Tool Output (InjecAgent Th
AI agents that call tools or APIs (search, email, databases) trust the data those tools return. This detection catches attackers who plant a command inside that returned data — disguised as part of a normal result — to trick the agent into taking a harmful action it wasn't asked to do.
How the attack works
An agent calls a tool or API and gets back a response that looks like a normal result: JSON, an HTTP status, a search hit, an email or database record. Buried in or appended to that legitimate-looking output is an instruction aimed at the agent itself, using phrasing like 'ignore the above', 'as an additional step', or 'IMPORTANT!!! you must now...'. That instruction tells the agent to perform a new sensitive action — transfer money, forward or email data, delete records, post data to an external endpoint, or grant access. Because the injected text arrives through the tool-response channel rather than from the user, the agent may treat it as a legitimate follow-up task and execute it.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 47aafb03-5719-4474-a6d3-63a6060ac7ae
- Severity
- High
Why it matters
An organization can lose money, data, or access control if the agent carries out the injected command — for example sending funds, leaking records to an outside party, or deleting information — without any user ever having asked for it.
What you can do
- →Treat all tool and API output as untrusted data, not as instructions, and keep it isolated from the agent's command-processing context.
- →Require explicit user or human confirmation before an agent executes sensitive actions (payments, data transfers, deletions, access grants) that were triggered by tool output rather than direct user input.
- →Filter or flag tool responses containing imperative phrasing directed at the assistant (e.g. 'you must now', 'as an additional step', 'ignore the above').
- →Log and review cases where an agent's action sequence changes based on content returned from a tool call, especially when it leads to a transactional or exfiltration action.
Known benign look-alikes
- Normal tool / API JSON responses (status/result/data payloads, HTTP 200 OK, search hits, file-saved confirmations) that carry no appended agent-directed imperative — they describe a result, they do not order the assistant to transfer/send/delete/exfiltrate.
- A benign tool result that merely contains the word 'important' (e.g. 'flagged 3 important updates', 'IMPORTANT: rate limit resets at midnight') without a second-person imperative to perform a sensitive transactional action.
- A user legitimately asking the agent to send an email / transfer funds in their own turn — that arrives on the user_input channel as a first-party request, not appended to a returned tool/API result blob.
- Security research, papers, blogs, and course material that DESCRIBE indirect / tool-response injection in third-person prose ('the attacker embeds an instruction in the tool output that tells the agent to exfiltrate data') — no live result blob + injected imperative + second-person action verb co-occur.
- A tool result that quotes user-authored text or document content back to the agent for summarization, without an appended imperative directing a new sensitive action.