Injected Advertising / Promotional Copy in the Response
An attacker hides instructions inside content an AI agent reads — a webpage, document, or email — telling it to slip advertising, discount codes, or brand promotion into its response to the user. This turns a trusted assistant into an unwitting ad channel or scam vector.
How the attack works
The attacker plants hidden text in a source the agent will process, such as a web page, PDF, or email, that the agent isn't supposed to treat as a command. That hidden text instructs the agent to output promotional content — a discount, a newsletter signup pitch, free shipping mention, brand plug, or investment offer — in its reply. The agent, unable to distinguish trusted instructions from injected ones, follows along and appends the promotional message to what it tells the user. The rule flags cases where three things line up together: an injection pattern, the agent's output being the delivery point, and a recognizable promotional lure.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- a4edb0c9-90ae-4198-b9fd-ccbacf305b15
- Severity
- Medium
Why it matters
Users receive answers polluted with unsolicited advertising or promotional pitches they never asked for, which damages trust in the agent and can be used to push scams, phishing offers, or fraudulent investment pitches under the guise of a trusted assistant.
What you can do
- →Treat all content an agent fetches from external sources (web pages, documents, emails) as untrusted input, not as instructions.
- →Strip or sandbox instructions found inside retrieved content before it reaches the model's context.
- →Review agent output logs for unexpected promotional language, links, or offers that were not part of the user's original request.
- →Add output filtering or a review step for agents that summarize or relay content from external, unvetted sources.
Known benign look-alikes
- Security documentation, papers, or test suites that describe this attack technique without executing it.
- Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.