Indirect Prompt Injection via Tool Responses
Attackers plant hidden commands inside content an AI agent will later fetch and process, such as a web page, API reply, or document. When the agent reads that content as part of its normal work, it may follow the hidden instructions instead of its actual task.
How the attack works
An attacker places crafted text like 'ignore previous instructions' or fake system markers inside a data source the agent is expected to consume, such as a search result, a tool's API response, or a retrieved file. The agent later calls a tool or performs a lookup and pulls in that poisoned content as part of its context. Because the agent cannot reliably distinguish trusted instructions from untrusted data, it may treat the injected text as a new command. This can redirect the agent into taking actions the operator never asked for, using whatever access or tools the agent already has.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9ebc8540-8552-453a-a0d7-f5c89454a689
- Severity
- High
Why it matters
An organization can lose control over what its AI agent does next: data exfiltration, unauthorized tool calls, or actions taken with the agent's existing permissions, all triggered by content the agent was simply supposed to read.
What you can do
- →Treat all external content fetched by agents (web pages, API responses, documents) as untrusted data, never as instructions.
- →Separate tool/data output from the instruction channel in agent architecture so retrieved text cannot be parsed as commands.
- →Review or sandbox high-privilege tool calls that follow ingestion of external content, especially unexpected new actions.
- →Audit security documentation and defense catalogues that quote injection phrases verbatim, since these can trigger detections identical to real payloads; keep such references clearly labeled as examples.
Known benign look-alikes
- Security documentation explaining indirect injection techniques
- IT change management documentation describing how a new configuration override replaces prior system settings, using phrases like 'this override replaces the original system configuration'
- Prompt-injection defence skills that quote the payload string verbatim in a catalogue of indicators to watch for ('Ignore previous instructions', '[SYSTEM]', 'You are now'). The quoted indicator and the live payload are the same characters, so conditions 0, 1 and 2 cannot separate them; this is the residual false-positive class and the reason the rule is held at maturity test rather than in the enforce lane.
- Product documentation that uses 'New instructions' or 'you are now' as ordinary English prose, for example a conversational-agent guide describing how an operator sends new instructions to a running agent